Detections
Analytics

6.2.14 Ensure 'MAINTPLAN_APP' Is Revoked From Unauthorized 'GRANTEE'

Information

The MAINTPLAN_APP role grants access to database maintenance plans. Unauthorized use can lead to disruptions in Oracle database operation and service.

This role should only be assigned to database administrators to prevent accidental or intentional maintenance plan modifications. A user with this role can alter or remove scheduled maintenance jobs, affecting database availability.

Solution

To remediate this setting, execute the following SQL statement, keeping in mind if this is granted in both container and pluggable database, you must connect to both places to revoke. Please ensure proper impact analysis is done before revoking the privilege from a role.

REVOKE MAINTPLAN_APP FROM <grantee>;

In the case of a grant via a role:

REVOKE <rolename> FROM <grantee>;

See Also

https://workbench.cisecurity.org/benchmarks/26139

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: OracleDB

Control ID: bb0c29873dc6e8b97d56c2223ef10a40aa35ebed4f5ebc0eb01d9624a122ed7e