CVE-2025-24874CWE-1021

Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice

Medium · published February 11, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2025-02-11T00:37Z
EPSS history
Timeline
  • 11 FEB 00:37Z
    Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice
    cvelistv5