TI-2023-16859 Aliases CVE-2023-33992 GHSA-pgvh-wr92-g752

Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA

LOW 29CWE-862Published 2023-07-11 · Updated 2024-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00444 38th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Business Warehouse and SAP BW/4HANA	SAP_BW 730; SAP_BW 731; SAP_BW 740; SAP_BW 750; DW4CORE 100; DW4CORE 200; DW4CORE 300	—	No fix listed	CNA

SAP Business Warehouse and SAP BW/4HANA VendorSAP Affected SAP_BW 730; SAP_BW 731; SAP_BW 740; SAP_BW 750; DW4CORE 100; DW4CORE 200; DW4CORE 300 Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:business_warehouse:730:::::::*	730	Vulnerable	SAP
cpe:2.3:a:sap:business_warehouse:731:::::::*	731	Vulnerable	SAP
cpe:2.3:a:sap:business_warehouse:740:::::::*	740	Vulnerable	SAP
cpe:2.3:a:sap:business_warehouse:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:bw\/4hana:100:::::::*	100	Vulnerable	SAP
cpe:2.3:a:sap:bw\/4hana:200:::::::*	200	Vulnerable	SAP
cpe:2.3:a:sap:bw\/4hana:300:::::::*	300	Vulnerable	SAP

cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:* Versions 200 Vulnerable ·SAP
cpe:2.3:a:sap:bw\/4hana:300:*:*:*:*:*:*:* Versions 300 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-33992
2026-10-03 Alias added: GHSA-pgvh-wr92-g752

References

Advisory 1

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Other 1

https://me.sap.com/notes/3088078

TI-2021-04563 SQL injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.9
TI-2021-04564 Code injection in SAP Business Warehouse CVSS 3.1HIGH 8.8
TI-2020-16301 OS command injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.1
TI-2021-04566 Missing authorization in SAP Business Warehouse CVSS 3.1MEDIUM 6.5
TI-2024-26524 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 6.1
TI-2024-26525 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences