CVE-2025-24875 Information

Description

SAP Commerce by default sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.

Reference

https://me.sap.com/notes/3555364 https://url.sap/sapsecuritypatchday https://url.sap/sapsecuritypatchday