PT-2023-4603 · Sap · Sap Bw/4Hana+1

Published 2023-07-11 · Updated 2023-07-19 · CVE-2023-33992

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Warehouse versions SAP BW 730 through SAP BW 750 SAP BW/4HANA versions DW4CORE 100 through DW4CORE 300

Description The issue is related to the SAP BW BICS communication layer, which may expose unauthorized cell values to the data response. To exploit this, a user needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level. This is due to weaknesses in the authorization procedure, which can allow a remote attacker to gain unauthorized access to protected information.

Recommendations For SAP Business Warehouse versions SAP BW 730 through SAP BW 750, ensure that users have proper authorizations on the query and keyfigure/measure level to minimize the risk of exploitation. For SAP BW/4HANA versions DW4CORE 100 through DW4CORE 300, consider restricting access to sensitive data until a fix is available. As a temporary workaround, consider implementing additional authorization checks on the data level to prevent unauthorized access.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-05010

CVE-2023-33992

Affected Products

Sap Bw/4Hana

Sap Business Warehouse

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33992 · Security Note
• https://bdu.fstec.ru/vul/2023-05010 · Security Note
• https://me.sap.com/notes/3088078 · Note