CVE-2025-24874

Summary

CVE-2025-24874 refers to a security vulnerability in SAP Commerce (Backoffice), where the application employs the outdated X-FRAME-OPTIONS header to prevent clickjacking attacks. Although this measure is currently effective, the support for this header may be phased out in future browsers in favor of the more advanced frame-ancestors Content Security Policy (CSP) directive. Consequently, the risk of clickjacking attacks increasing and potentially exposing or modifying sensitive data becomes a concern.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.