A managed connection pool may reuse a server session for successive clients without resetting session-level state such as temporary tables, prepared statements, or an assumed role. State set by one client can then be read or acted on by another, impacting the confidentiality and integrity of data and obscuring which client performed an action.
Session State Leaks Between Pooled Connections
CCC.RDMS.TH09
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP12 | Managed Connection Pooling | The service may be configured to place a managed connection pool in front of the database so that client connections are reused and bounded. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CN09 | Reset Session State Between Pooled Connections | Ensure that a managed connection pool clears session-level state before handing a server connection to another client, so that no client observes or acts on state set by a previous client. |