Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA (SAP_SE SAP Business Warehouse and SAP BW/4HANA)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.44 % · percentile 39 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 4.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-38116
- GCVE · GCVE-0-2023-33992
CERT-FR advisories
- CERTFR-2023-AVI-0531 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:300:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Business Warehouse and SAP BW/4HANA | affected SAP_BW 730 ; affected SAP_BW 731 ; affected SAP_BW 740 ; affected SAP_BW 750 ; affected DW4CORE 100 ; affected DW4CORE 200 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |