What’s Vulnerable › Vulnerabilities

CVE-2025-24875: SameSite Defense in Depth not applied for some cookies in SAP Commerce

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-11 · updated 2026-06-17
• Weakness: CWE-352

Description

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.

Affected products

• SAP SE SAP Commerce: HY_COM 2205, COM_CLOUD 2211

References

• https://me.sap.com/notes/3555364
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-24875 or the next vulnerability affects your stack