STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

The Oracle WITH GRANT OPTION privilege must be limited when granted to nondatabase administrator (DBA) or nonapplication administrator user accounts.

DISA Rule

SV-270523r1167746_rule

Vulnerability Number

V-270523

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-009000

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Revoke privileges granted the WITH GRANT OPTION from non-DBA and accounts that do not own application objects or document the need for WITH GRANT OPTION and get approval.

Re-grant privileges without specifying WITH GRANT OPTION.

Note: Do not revoke the system-generated grants such as those found on SYS_PLSQL_% objects. They are system generated object types (aka ShadowTypes), created internally by Oracle when using the Pipelined Table Functions. This can result in (incorrect) compilation failures and/or invalidations when the users who are supposed to have access to the shadow types find themselves without access.

Check Contents

Execute the query:

select grantee||': '||owner||'.'||table_name
from dba_tab_privs
where grantable = 'YES'
and grantee not in (select distinct owner from dba_objects)
and grantee not in (select grantee from dba_role_privs where granted_role = 'DBA')
and table_name not like 'SYS_PLSQL_%'
order by grantee;

If any accounts are listed, verify accounts are documented and approved for the WITH GRANT option.
If non-DBA interactive user or application accounts have WITH GRANT without being documented and approved, this is a finding.

Vulnerability Number

V-270523

Documentable

False

Rule Version

O19C-00-009000

Severity Override Guidance

Execute the query:

select grantee||': '||owner||'.'||table_name
from dba_tab_privs
where grantable = 'YES'
and grantee not in (select distinct owner from dba_objects)
and grantee not in (select grantee from dba_role_privs where granted_role = 'DBA')
and table_name not like 'SYS_PLSQL_%'
order by grantee;

If any accounts are listed, verify accounts are documented and approved for the WITH GRANT option.
If non-DBA interactive user or application accounts have WITH GRANT without being documented and approved, this is a finding.

Check Content Reference

M

Target Key

5672