CVE-2023-33992

MEDIUM

SAP Business Warehouse and SAP BW/4HANA - Missing Authorization in BICS Communication Layer

Title source: llm
STIX 2.1

Description

The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.

References (2)

Core 2

Scores

CVSS v3 4.5
EPSS 0.0013
EPSS Percentile 32.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (7)
sap/business_warehouse 730
sap/business_warehouse 731
sap/business_warehouse 740
sap/business_warehouse 750
sap/bw\/4hana 100
sap/bw\/4hana 200
sap/bw\/4hana 300
Published Jul 11, 2023
Tracked Since Feb 18, 2026