How severe is CVE-2025-24874?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.8 out of 10.

What type of vulnerability is CVE-2025-24874?

This is classified as CWE-1021, which is a common weakness in software security.

CVE-2025-24874 - MEDIUM Severity | CVSS 6.8

Vulnerability Description

SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.

Related Vulnerabilities

CVE-2024-2177

MEDIUM

CVSS:6.8(Medium)

A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker...

CWE-10212024

CVE-2013-2675

MEDIUM

CVSS:6.5(Medium)

Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.

CWE-10212013

CVE-2017-20041

MEDIUM

CVSS:6.5(Medium)

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title lead...

CWE-10212017

CVE-2017-5016

MEDIUM

CVSS:6.5(Medium)

Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a ...

CWE-10212017

CVE-2017-5697

MEDIUM

CVSS:6.5(Medium)

Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129 potentially allowing a remote...

CWE-10212017

CVE-2017-7440

MEDIUM

CVSS:6.5(Medium)

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking...

CWE-10212017