CVE-2025-24875: SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in…

PriorityP432medium6.8CVSS 3.1

AVNACHPRNUIRSUCHIHAN

EPSS

0.17%

6.5th percentile

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sap_se	sap_commerce	—	—
sap_se	sap_commerce	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.