SAP Commerce Clickjacking Vulnerability via Deprecated X-FRAME-OPTIONS Header

A vulnerability exists in SAP Commerce (Backoffice) due to the use of the outdated X-FRAME-OPTIONS header for clickjacking protection. While this method is currently effective, it may become inadequate in the future as browsers could phase out support for this header in favor of the frame-ancestors Content Security Policy directive. If that occurs, clickjacking could be feasible, potentially leading to the exposure and unauthorized modification of sensitive information.

Impact

Exploitation of this vulnerability could allow clickjacking attacks, leading to the exposure and modification of sensitive information.

Remediation

Users are advised to review and implement the latest SAP Security Notes. For guidance on accessing and applying these security updates, refer to the SAP Security Notes FAQs.