Clickjacking Vulnerability in SAP Commerce Backoffice

CVE-2025-24874

What is CVE-2025-24874?

SAP Commerce's Backoffice currently employs the deprecated X-FRAME-OPTIONS header to mitigate clickjacking attacks. While effective now, there are concerns that future browser updates may eliminate support for this header, replacing it with the frame-ancestors Content Security Policy directive. Such changes could leave systems vulnerable to clickjacking attempts, potentially allowing attackers to manipulate and gain access to sensitive information. Businesses using SAP Commerce should evaluate their security posture and prepare for this possible transition.

References