STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Application role permissions must not be assigned to the Oracle PUBLIC role.

DISA Rule

SV-270532r1064874_rule

Vulnerability Number

V-270532

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-010000

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Revoke role grants from PUBLIC.

Do not assign role privileges to PUBLIC.

From SQL*Plus:

revoke [role name] from PUBLIC;

Check Contents

From SQL*Plus:

select granted_role from dba_role_privs where grantee = 'PUBLIC';

If any roles are listed, this is a finding.

Vulnerability Number

V-270532

Documentable

False

Rule Version

O19C-00-010000

Severity Override Guidance

From SQL*Plus:

select granted_role from dba_role_privs where grantee = 'PUBLIC';

If any roles are listed, this is a finding.

Check Content Reference

M

Target Key

5672