If a database cursor is not closed properly, then it could
become accessible to other users while retaining the same privileges that were
originally assigned, leaving the cursor "dangling."
Extended Description
For example, an improper dangling cursor could arise from unhandled
exceptions. The impact of the issue depends on the cursor's role, but SQL
injection attacks are commonly possible.
Time of Introduction
Implementation
Applicable Platforms
Languages
SQL
Modes of Introduction
This issue is currently reported for unhandled exceptions, but it is
theoretically possible any time the programmer does not close the cursor at
the proper time.
Potential Mitigations
Phase
Description
Close cursors immediately after access to them is complete. Ensure
that you close cursors if exceptions occur.
Background Details
A cursor is a feature in Oracle PL/SQL and other languages that provides a
handle for executing and accessing the results of SQL queries.
Weakness Ordinalities
Ordinality
Description
Primary
This could be primary when the programmer never attempts to close the
cursor when finished with it.
Resultant
(where the
weakness is typically related to the presence of some other
weaknesses)
Description
