CVE-2025-24874: Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice
First published: Tue Feb 11 2025(Updated: )
SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Commerce |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-24874?
CVE-2025-24874 has a moderate severity level due to the reliance on the deprecated X-FRAME-OPTIONS header for clickjacking protection.
How do I fix CVE-2025-24874?
To fix CVE-2025-24874, migrate to using the 'frame-ancestors' directive in your Content Security Policy (CSP) instead of relying on the X-FRAME-OPTIONS header.
Which software is affected by CVE-2025-24874?
CVE-2025-24874 affects SAP Commerce, specifically in its Backoffice component.
What is the main issue with CVE-2025-24874?
The main issue with CVE-2025-24874 is the potential future discontinuation of support for the X-FRAME-OPTIONS header by browsers, which could compromise clickjacking protection.
When was CVE-2025-24874 disclosed?
CVE-2025-24874 was disclosed in 2025, addressing a vulnerability related to clickjacking protection in SAP Commerce.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/severity
- agent/weakness
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/sap
- canonical/sap commerce