Is configuring Database mail and sending email using sp_send_dbmail considered a security threat?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Configuring DB mail is not a security risk. DB mail is disabled by default, This way, if you don't need DB mail, you are reducing the surface area of your SQL server. If you need to use DB mail, you can enable and start using it.
Xp_cmdshell is a bit more powerful and is better left disabled.
In a vacuum, any activated feature is an additional attack vector (or, additional "surface area" for the system). That said, I've never read or heard of any attack or exploit using DB Mail.