Auth bypass in SAP Business Warehouse
CVE-2023-33992
The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (36.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- SAP Business Warehouse — versions 730, 731, 740
- SAP Bw\/4hana — versions 100, 200, 300
- SAP Se Business Warehouse And Bw/4hana — versions SAP_BW 730, SAP_BW 731, SAP_BW 740
Weakness classification (CWE)
References
- me.sap.com/notes/3088078 (Permissions Required)
- www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-33992?
- CVE-2023-33992 is a medium-severity vulnerability in SAP Business Warehouse, classified under Missing Authorization. CVSS score: 4.5/10. Published 2023-07-11.
- How severe is CVE-2023-33992?
- Medium severity. CVSS v3 base score is 4.5 out of 10.