DerScanner
Home / Vulnerability Database / T-SQL : Insecure GRANT usage
T-SQL

T-SQL : Insecure GRANT usage

Classification

OWASP Top 10 2013
A7-Missing Function Level Access Control
OWASP Top 10 2017
A5-Broken Access Control
OWASP Top 10 2021
A1-Broken Access ControlA4-Insecure Design
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (a)(1)
CWE
CWE-266CWE-1033

Overview

ALL and ALL PRIVILEGES grant all applicable privileges to the user. Granting all privileges may be insecure.

References

  1. CWE-269: Improper Privilege Management
  2. Grant a Permission to a Principal - msdn.microsoft.com
  3. GRANT - msdn.microsoft.com
  4. Securing Your Database Server
  5. Server-Level Roles - msdn.microsoft.com
  6. OWASP Top 10 2017-A5-Broken Access Control
  7. CWE-1033
MEDIUM

DerScanner Severity Score

Do you want to fix T-SQL : Insecure GRANT usage in your application?

See also

T-SQL

T-SQL : Weak encryption algorithm

T-SQL

T-SQL : Weak hashing algorithm

T-SQL

T-SQL : Weak random number generator