CVE-2023-33992 Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA

Medium 4.5 Published 11 Jul 2023 Updated 29 Oct 2024

An attacker with query and keyfigure authorizations can read unauthorized cell values due to a missing data-level authorization check in SAP BW.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-33992?

CVE-2023-33992 is a medium-severity missing authorization vulnerability in SAP_SE SAP Business Warehouse and SAP BW/4HANA, published on 11 Jul 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.

Weakness: CWE-862

Which versions are affected by CVE-2023-33992?

It affects 2 products.

Products include Sap Business Warehouse, Sap Bw\/4hana.

How do I fix CVE-2023-33992?

No fix has been published for CVE-2023-33992 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-33992 being exploited?

There is no known exploitation of CVE-2023-33992 in the wild and no public exploit code.

Sources

Also known as GHSA-pgvh-wr92-g752.