Log in Start free

Vulnerability · Published Jul 11, 2023 · Assigned by sap

CVE-2023-33992Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA

Medium 4.5

In plain English

A medium-severity missing authorization in SAP Business Warehouse and SAP BW/4HANA from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)4.5Medium
Exploit odds (30 days)0.4%top 61.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP Business Warehouse and SAP BW/4HANA SAP_BW 730SAP_BW 731SAP_BW 740SAP_BW 750DW4CORE 100DW4CORE 200DW4CORE 300

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

References