title: Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA
description: The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.
problem types: CWE-862: Missing Authorization
affected:
{
defaultStatus: unaffected
product: SAP Business Warehouse and SAP BW/4HANA
vendor: SAP_SE
versions:
status: affected, version: SAP_BW 730
status: affected, version: SAP_BW 731
status: affected, version: SAP_BW 740
status: affected, version: SAP_BW 750
status: affected, version: DW4CORE 100
status: affected, version: DW4CORE 200
status: affected, version: DW4CORE 300
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL