STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

MarkLogic Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

DISA Rule

SV-220377r961353_rule

Vulnerability Number

V-220377

Group Title

SRG-APP-000340-DB-000304

Rule Version

ML09-00-006700

Severity

CAT II

CCI(s)

• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

Review MarkLogic User and Role configurations to ensure correct privileges are assigned and update as required.

1. Navigate to the MarkLogic Admin page >> Security >> Roles.
2. Select specific roles (usually custom defined roles by administrator) and only apply privileges with the least amount of permissions required for a given role.
3. Navigate to the MarkLogic Admin Page >> Security >> Users.
4. Select specific users (usually custom defined users by an administrator) and add/remove roles allowing for the least amount of privileges required for the specified user.
5. Save configuration and repeat for each user-defined User/Role.

Check Contents

Review the MarkLogic system documentation to obtain the definition of the database/DBMS functionality considered privileged in the context of the system in question.

Review MarkLogic users and assigned roles
1. Navigate to the MarkLogic Admin page >> Security >> Roles.
2. Validate user-created roles have appropriate permissions/roles applied.
3. Navigate to the MarkLogic Admin page >> Security >> Users.
4. Verify user-created Users are only granted roles meeting their specific requirements and do not allow for unnecessary elevated privileges.

If Users are assigned roles providing unnecessary elevated or privileged permissions, this is a finding.

If Roles are defined with unnecessary elevated permissions, this is a finding.

Vulnerability Number

V-220377

Documentable

False

Rule Version

ML09-00-006700

Severity Override Guidance

Review the MarkLogic system documentation to obtain the definition of the database/DBMS functionality considered privileged in the context of the system in question.

Review MarkLogic users and assigned roles
1. Navigate to the MarkLogic Admin page >> Security >> Roles.
2. Validate user-created roles have appropriate permissions/roles applied.
3. Navigate to the MarkLogic Admin page >> Security >> Users.
4. Verify user-created Users are only granted roles meeting their specific requirements and do not allow for unnecessary elevated privileges.

If Users are assigned roles providing unnecessary elevated or privileged permissions, this is a finding.

If Roles are defined with unnecessary elevated permissions, this is a finding.

Check Content Reference

M

Target Key

4064