STIGQter STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must, for password-based authentication, require immediate selection of a new password upon account recovery.

DISA Rule

SV-270588r1065042_rule

Vulnerability Number

V-270588

Group Title

SRG-APP-000855-DB-000240

Rule Version

O19C-00-019900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the DBMS to require immediate selection of a new password upon account recovery.

One way to configure this is to ensure that all scripts, functions, triggers, and stored procedures that are used to create a user or reset a user's password should include a line similar to the following:
alter user <username> password expire;

Check Contents

Verify the database management system (DBMS) is configured to require immediate selection of a new password upon account recovery.

All scripts, functions, triggers, and stored procedures that are used to create a user or reset a user's password should include a line similar to the following:
alter user <username> password expire;

If they do not, this is a finding.

If the DBMS is not configured to require immediate selection of a new password upon account recovery, this is a finding.

Vulnerability Number

V-270588

Documentable

False

Rule Version

O19C-00-019900

Severity Override Guidance

Verify the database management system (DBMS) is configured to require immediate selection of a new password upon account recovery.

All scripts, functions, triggers, and stored procedures that are used to create a user or reset a user's password should include a line similar to the following:
alter user <username> password expire;

If they do not, this is a finding.

If the DBMS is not configured to require immediate selection of a new password upon account recovery, this is a finding.

Check Content Reference

M

Target Key

5672