CVE-2025-24875: SameSite Defense in Depth not applied for some cookies in SAP Commerce
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24875?
CVE-2025-24875 is considered to have a medium severity due to its impact on CSRF protection.
How do I fix CVE-2025-24875?
To fix CVE-2025-24875, configure the SameSite attribute of affected cookies to 'Lax' or 'Strict' instead of 'None'.
What software is affected by CVE-2025-24875?
CVE-2025-24875 affects SAP Commerce where certain cookies are set with the SameSite attribute as None.
What is the risk associated with CVE-2025-24875?
The risk associated with CVE-2025-24875 includes potential CSRF attacks due to inadequate cookie protection.
Is there a workaround for CVE-2025-24875?
A potential workaround for CVE-2025-24875 is to review and modify cookie settings in the application configuration to enhance security.