Can OPA privileges and roles over SYS.USER$ table (SELECT,UNLIMITED TABLESPACE, RESOURCE , GRANT ANY ROLE) be removed? (Doc ID 2522104.1)

Last updated on JULY 22, 2024

Applies to:

Goal

OPA account has access(eg : SELECT privilege) to SYS.USER$ and also have UNLIMITED TABLESPACE, RESOURCE , GRANT ANY ROLE.

Impact: This can allow non-privileged users the authorization to open SYS.USER$ table and capture password hashes which can break confidentiality.

Can these privilege(s)/role(s) be removed from OPA?

Will this action have any impact on the OC/RDC application? 

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.