CVE-2023-33992
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The BICS communication layer in SAP BW and SAP BW/4HANA may expose unauthorized cell values in the response to queries. However, appropriate authorization is still required at the query and key figure level.
Risk Assessment
The organization may be at risk of exposing sensitive data, potentially leading to privacy breaches and information security issues. Attackers could exploit this vulnerability if they have the necessary permissions.
Recommendation
It is recommended to review and strengthen access controls for queries and key figures in the SAP BW system. Additionally, monitoring access logs for unauthorized attempts is advised.
Original NVD description (English source)
The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.