STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must separate user functionality (including user interface services) from database management functionality.

DISA Rule

SV-253705r1137655_rule

Vulnerability Number

V-253705

Group Title

SRG-APP-000211-DB-000122

Rule Version

MADB-10-004600

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.

Weight

10

Fix Recommendation

Configure MariaDB Enterprise Server to separate database administration and general user functionality.

Do not grant Create user, Event, Process, Proxy, Reload, Replication client, Replication slave, Show databases, Shutdown, Super, Create tablespace privileges to users and roles that do not require it.

To remove privileges, refer to the following examples:

1. Revoke privileges from a specific user:

MariaDB> REVOKE SUPER, PROCESS ON *.* FROM 'user'@'host';

2. Revoke privileges from a role:

MariaDB> REVOKE 'role' FROM 'user'@'host';

Check Contents

To show the list of system privileges that the MariaDB server supports, run:
MariaDB> SHOW PRIVILEGES;

Gather a list of SHOW GRANTS commands. SHOW GRANTS will list the privileges granted to the account.

Run this database query to create the SHOW GRANTS script for each user:

MariaDB> SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'N';

Run each SHOW GRANTS command for each user.

MariaDB> SHOW GRANTS FOR 'user'@'host';

If any nonadministrative role has any one of the following privileges, this is a finding.

Create user
Event
Process
Proxy
Reload
Replication client
Replication slave
Show databases
Shutdown
Super

If administrator and general user functionality are not separated either physically or logically, this is a finding.

Vulnerability Number

V-253705

Documentable

False

Rule Version

MADB-10-004600

Severity Override Guidance

To show the list of system privileges that the MariaDB server supports, run:
MariaDB> SHOW PRIVILEGES;

Gather a list of SHOW GRANTS commands. SHOW GRANTS will list the privileges granted to the account.

Run this database query to create the SHOW GRANTS script for each user:

MariaDB> SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'N';

Run each SHOW GRANTS command for each user.

MariaDB> SHOW GRANTS FOR 'user'@'host';

If any nonadministrative role has any one of the following privileges, this is a finding.

Create user
Event
Process
Proxy
Reload
Replication client
Replication slave
Show databases
Shutdown
Super

If administrator and general user functionality are not separated either physically or logically, this is a finding.

Check Content Reference

M

Target Key

5475