AI analysis
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can write security-sensitive information into diagnostic logs when certain configurations are enabled (CWE-532). An attacker who already has access to those log files — for example an operator, insider, or someone who has compromised the host or a log-aggregation pipeline — could extract the recorded secrets and use them to gain unauthorized access to protected resources. The 8.1 CVSS score (integrity and availability high) reflects that stolen credentials could allow an attacker to modify or destroy protected data rather than merely read it. The flaw requires prior access to the logs and no network-facing authentication bypass, so it is primarily a risk in environments with broad log access or shared diagnostic collections. No public proof of concept exists, the issue is not in CISA's KEV catalog, and no exploitation has been reported.
What to do: Upgrade to MarkLogic Server 12.1.0 or later (12.x line) or 11.3.7 or later (11.x line). Until patched, restrict filesystem and log-aggregation access to diagnostic logs, and audit existing logs to determine whether sensitive values were recorded; rotate any credentials, keys, or tokens that may have been captured. Also verify whether the diagnostic configuration that triggers the sensitive logging is actually enabled in your environment.
Affected
| Progress MarkLogic Server | 12.x before 12.1.0 |
| Progress MarkLogic Server | 11.x before 11.3.7 |
Estimated exposure
moderatelow thousands of MarkLogic deployments worldwide, most on-premises or private-cloud — MarkLogic is a commercial enterprise NoSQL database with no public install counts; deployments cluster in government, healthcare, and financial services and public scans show only a small fraction of instances internet-exposed, so the…
Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.