Privilege Escalation via Higher-Order XQuery Functions in Progress MarkLogic Server
AI analysis
Progress MarkLogic Server improperly manages privileges when certain higher-order XQuery functions are called: user-controlled values supplied to those functions are evaluated in an elevated security context rather than under the attacker's own permissions (CWE-269). The flaw is triggered when attacker-supplied input reaches these higher-order functions, for example through an application that builds XQuery from user data or via direct query access to the server. A successful exploit lets the attacker escalate beyond their granted permissions — the CVSS 3.1 vector (8.6, AV:N/PR:N/S:C/I:H) indicates the issue is reachable over the network without authentication or user interaction, with high impact to data integrity. Affected deployments are MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. There is no known public proof of concept and the CVE is not on the CISA KEV list, so exploitation is not currently observed.
What to do: Upgrade MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later. Until patched, restrict network access to MarkLogic HTTP/App servers and the query console, audit application code that passes user-controlled values into higher-order XQuery functions, and review server audit logs for XQuery executions that ran under elevated privileges or modified data the submitting user should not have been able to touch.
Affected
| Progress MarkLogic Server | 12.x before 12.1.0 |
| Progress MarkLogic Server | 11.x before 11.3.7 |
Estimated exposure
nicheLikely low thousands of deployments worldwide, with only hundreds internet-exposed (clearly an estimate) — MarkLogic is an enterprise NoSQL database sold to a limited base of large organizations and typically deployed in private data centers, and public internet scans historically show only a few hundred to low thousands of reachable instances.
Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.