Granting all privileges on an object may give users more privileges than expected.
Using the ALL PRIVILEGES
or ALL
option will grant the user all of the permissions that can be applied to an object. The programmer may not be aware of all of the privileges being granted.
Example: An administrator may want to give a user the ability to update the data in the procedure.
GRANT ALL ON employees TO john_doe;
john_doe
now has permission to change the definition of the table.[1] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 265
[2] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.5.7, Requirement 7.2
[3] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.8