What is CVE-2023-33992?

CVE-2023-33992 is a medium-severity vulnerability in SAP Business Warehouse, classified under Missing Authorization. CVSS score: 4.5/10. Published 2023-07-11.

How severe is CVE-2023-33992?

Medium severity. CVSS v3 base score is 4.5 out of 10.

Auth bypass in SAP Business Warehouse

CVE-2023-33992

The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.

Vulnerability class: Broken Access Control

EPSS: 0.004 (36.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N.

Affected products

Sap Business_warehouse — versions 730, 731, 740
Sap Bw\/4hana — versions 100, 200, 300
Sap_se Sap Business Warehouse And Bw/4hana — versions SAP_BW 730, SAP_BW 731, SAP_BW 740

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-33992?: CVE-2023-33992 is a medium-severity vulnerability in SAP Business Warehouse, classified under Missing Authorization. CVSS score: 4.5/10. Published 2023-07-11.
How severe is CVE-2023-33992?: Medium severity. CVSS v3 base score is 4.5 out of 10.