CVE-2025-24875

SameSite Defense in Depth not applied for some cookies in SAP Commerce

State: Published
Severity: 6.8 Medium
Published: Feb 11, 2025
Updated: Feb 18, 2025
Reserved: Jan 27, 2025

Description

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	sap

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
SAP CommerceSAP_SE	HY_COM 2205Affected COM_CLOUD 2211Affected

References

https://me.sap.com/notes/3555364
https://url.sap/sapsecuritypatchday

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.