If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling."
Extended Description
For example, an improper dangling cursor could arise from unhandled exceptions. The impact of the issue depends on the cursor's role, but SQL injection attacks are commonly possible.
Time of Introduction
Implementation
Applicable Platforms
Languages
SQL
Modes of Introduction
This issue is currently reported for unhandled exceptions, but it is
theoretically possible any time the programmer does not close the cursor at
the proper time.
Common Consequences
Scope
Effect
Confidentiality
Integrity
Technical Impact: Read application data; Modify application data
Potential Mitigations
Phase: Implementation
Close cursors immediately after access to them is complete. Ensure
that you close cursors if exceptions occur.
Background Details
A cursor is a feature in Oracle PL/SQL and other languages that provides a
handle for executing and accessing the results of SQL queries.
Weakness Ordinalities
Ordinality
Description
Primary
This could be primary when the programmer never attempts to close the
cursor when finished with it.
Resultant
(where
the weakness is typically related to the presence of some other
weaknesses)
Use of the Common Weakness Enumeration and the associated references from this website are subject to the
Terms of Use. For more information, please email
cwe@mitre.org.
Description
