AI analysis
Progress MarkLogic Server contains an improper privilege management flaw (CWE-269) in certain forest-management operations, affecting 12.x releases before 12.1.0 and 11.x releases before 11.3.7. A remote attacker who already holds forest-management privileges (a lower-privileged, non-administrator role) can abuse these operations to create a persistent unauthorized administrator account. Successful exploitation gives the attacker complete unauthorized administrative control of the database server, with an attacker-controlled backdoor account that survives patching unless separately removed. The flaw is rated critical (CVSS 3.1 base 9.9) because it is network-exploitable with low complexity, though it requires an attacker to first obtain forest-management credentials. It is not currently listed in CISA's KEV catalog, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.
What to do: Upgrade to MarkLogic Server 12.1.0 or later (12.x line) or 11.3.7 or later (11.x line) as soon as possible. Restrict which users hold forest-management privileges and limit network access to MarkLogic management ports to trusted hosts. Because the flaw enables a persistent backdoor administrator account, audit user and role lists for unexpected admin-role accounts and review audit logs for unusual forest-management activity before and after patching.
Affected
| Progress MarkLogic Server | 12.x before 12.1.0 |
| Progress MarkLogic Server | 11.x before 11.3.7 |
Estimated exposure
moderatelikely low thousands of deployments (order of 1k–10k servers), with only a small fraction internet-exposed — MarkLogic is an enterprise NoSQL database sold to a limited customer base (commonly government, financial services, publishing, and healthcare organizations) and is typically deployed in data centers or private clouds rather than directly…
Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.