Detections
Analytics

4.3.11 Ensure 'GRANT ANY ROLE' Is Revoked from Unauthorized 'GRANTEE'

Information

As authorization to use the GRANT ANY ROLE capability can allow an unauthorized user to potentially access/change confidential data or damage the data catalog due to potential complete instance access, this capability should be restricted according to the needs of the organization.

Solution

To remediate this setting execute the following SQL statement. REVOKE GRANT ANY ROLE FROM <grantee>;

See Also

https://workbench.cisecurity.org/files/601

Item Details

Plugin: OracleDB

Control ID: 6196d44f7b1672a3064242b90964987fc31b5df938e120628dfe67e8c2610a3c