Vulnerability Details : CVE-2023-33992
The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.
Products affected by CVE-2023-33992
- cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:*
- cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:*
- cpe:2.3:a:sap:bw\/4hana:300:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-33992
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 35 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-33992
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
0.9
|
3.6
|
SAP SE | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2023-33992
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: cna@sap.com (Primary)
References for CVE-2023-33992
-
https://me.sap.com/notes/3088078
SAP for Me: Sign InPermissions Required
-
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
SAP Patch Day BlogVendor Advisory
Jump to