CVE-2025-24970

Summary

CVE-2025-24874: SAP Commerce (Backoffice) relies on the outdated X-FRAME-OPTIONS header for clickjacking prevention. Although functional at present, this safeguard may become obsolete as browsers shift towards frame-ancestors Content Security Policy (CSP) directives, potentially leaving the system prone to clickjacking attacks and subsequent exposure or modification of sensitive information.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.