SAP Commerce SameSite Cookie Vulnerability in Authentication Cookies

A vulnerability exists in SAP Commerce due to certain cookies, including authentication cookies used in SAP Commerce Backoffice, being set with the SameSite attribute configured to None. This default setting weakens protection against Cross-Site Request Forgery (CSRF) attacks and may cause compatibility issues in the future.

Impact

The vulnerability may lead to increased risk of CSRF attacks and potential future compatibility issues.

Remediation

Users are advised to review and implement the guidance provided in the SAP Security Notes. SAP Security Patch Day occurs on the second Tuesday of each month, when SAP publishes important security updates. For more information, consult the SAP Security Notes FAQ.