STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

DISA Rule

SV-253671r960882_rule

Vulnerability Number

V-253671

Group Title

SRG-APP-000090-DB-000065

Rule Version

MADB-10-000600

Severity

CAT II

CCI(s)

• CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.

Weight

10

Fix Recommendation

Grant the necessary privileges to authorized users. Example:

MariaDB> GRANT ALL PRIVILEGES ON mysql.server_audit_filters TO 'username'@'host';
MariaDB> GRANT ALL PRIVILEGES ON mysql.server_audit_users TO 'username'@'host';

For users found with access who are not authorized to modify audit filters, review the user's privileges, and update accordingly.

Check Contents

MariaDB Enterprise Audit plugin stores audit filters in the table mysql.server_audit_filters. Any users with update/delete/insert access to this table can modify the audit filters.

Users with global insert, update, delete, and/or drop privileges can modify audit filters. Find users with global insert, update, delete, and/or drop privileges:

MariaDB> SELECT user, host, insert_priv, update_priv, delete_priv, drop_priv
FROM mysql.user
WHERE insert_priv = 'y'
OR update_priv = 'y'
OR delete_priv = 'y'
OR drop_priv = 'y';

Users with insert, update, delete, and/or drop privileges on the mysql database can modify audit filters. Find users with insert, update, delete, and/or drop privileges on the mysql database:

MariaDB> SELECT user, host, insert_priv, update_priv, delete_priv, drop_priv
FROM mysql.db
WHERE db = 'mysql'
AND (insert_priv = 'y'
OR update_priv = 'y'
OR delete_priv = 'y'
OR drop_priv = 'y'
);

Users with insert, update, delete, and/or drop privileges on the server_audit_filters and server_audit_users tables can modify audit filters. Find users with insert, update, delete, and/or drop privileges on the mysql database:

MariaDB> SELECT user, host, db, table_name, grantor, table_priv, timestamp, column_priv
FROM mysql.tables_priv
WHERE db = 'mysql'
AND table_name IN ('server_audit_filters','server_audit_users')
AND (table_priv LIKE '%Insert%'
OR table_priv LIKE '%Update%'
OR table_priv LIKE '%Delete%'
OR table_priv LIKE '%Drop%'
);

If any users with the above privileges are found which should not have access to modify audit filters, this is a finding.

Vulnerability Number

V-253671

Documentable

False

Rule Version

MADB-10-000600

Severity Override Guidance

MariaDB Enterprise Audit plugin stores audit filters in the table mysql.server_audit_filters. Any users with update/delete/insert access to this table can modify the audit filters.

Users with global insert, update, delete, and/or drop privileges can modify audit filters. Find users with global insert, update, delete, and/or drop privileges:

MariaDB> SELECT user, host, insert_priv, update_priv, delete_priv, drop_priv
FROM mysql.user
WHERE insert_priv = 'y'
OR update_priv = 'y'
OR delete_priv = 'y'
OR drop_priv = 'y';

Users with insert, update, delete, and/or drop privileges on the mysql database can modify audit filters. Find users with insert, update, delete, and/or drop privileges on the mysql database:

MariaDB> SELECT user, host, insert_priv, update_priv, delete_priv, drop_priv
FROM mysql.db
WHERE db = 'mysql'
AND (insert_priv = 'y'
OR update_priv = 'y'
OR delete_priv = 'y'
OR drop_priv = 'y'
);

Users with insert, update, delete, and/or drop privileges on the server_audit_filters and server_audit_users tables can modify audit filters. Find users with insert, update, delete, and/or drop privileges on the mysql database:

MariaDB> SELECT user, host, db, table_name, grantor, table_priv, timestamp, column_priv
FROM mysql.tables_priv
WHERE db = 'mysql'
AND table_name IN ('server_audit_filters','server_audit_users')
AND (table_priv LIKE '%Insert%'
OR table_priv LIKE '%Update%'
OR table_priv LIKE '%Delete%'
OR table_priv LIKE '%Drop%'
);

If any users with the above privileges are found which should not have access to modify audit filters, this is a finding.

Check Content Reference

M

Target Key

5475