ABSTRACT

Granting all privileges on an object may give users more privileges than expected.

EXPLANATION

Using the ALL PRIVILEGES or ALL option will grant the user all of the permissions that can be applied to an object. The programmer may not be aware of all of the privileges being granted.

Example: An administrator may want to give a user the ability to update the data in the procedure.


GRANT ALL ON employees TO john_doe;


In addition to the ability to select, update, add, and remove rows, john_doe now has permission to change the definition of the table.

REFERENCES

[1] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 265

[2] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.5.7, Requirement 7.2

[3] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.8