AI analysis
Progress MarkLogic Server contains a critical (CVSS 9.9) XQuery injection flaw classified as CWE-269 (improper privilege management) in a deprecated Management API package path. A remote attacker who already holds manage-user-level credentials can supply crafted input through the deprecated Management API to escalate their privileges and gain persistent unauthorized administrative control of the server. The vulnerability affects MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. Because successful attacks grant persistent admin access with high confidentiality, integrity, and availability impact (scope changed), compromised instances should be treated as fully controlled. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and there are no reports of in-the-wild exploitation.
What to do: Upgrade MarkLogic Server 12.x to 12.1.0 or later and 11.x to 11.3.7 or later as soon as possible. If patching is delayed, restrict or remove access to the deprecated Management API package path, tightly limit which accounts hold the manage-user role, and keep the Management API off any internet-facing network. Because exploitation grants persistent administrative control, audit for unexpected administrative users, suspicious manage-user activity, and rogue persistent changes, and rotate Management API credentials.
Affected
| Progress MarkLogic Server | 12.x before 12.1.0 |
| Progress MarkLogic Server | 11.x before 11.3.7 |
Estimated exposure
nichelikely on the order of a few thousand enterprise deployments; exact count unknown — MarkLogic is a commercial enterprise NoSQL database licensed to large organizations (finance, government, healthcare, publishing) rather than a mass-market product, there are no public install counts, and deployments are typically…