AI analysis
Progress MarkLogic Server contains an improper privilege management flaw (CWE-269) in which a remote attacker who already has query-execution access can invoke an XQuery evaluation function without the additional evaluation privilege that should be required. Triggering the flaw is a low-complexity, network-based action by an authenticated, low-privileged user, and successful abuse yields server-side code execution with elevated permissions — reflected in a critical 9.9 CVSS score with complete impact to confidentiality, integrity, and availability beyond the vulnerable component. Affected deployments are MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. Because exploitation requires an account with query privileges, the most exposed organizations are those that grant broad query access to many users or expose database query endpoints externally. No public proof-of-concept exists and the issue is not on the CISA Known Exploited Vulnerabilities list, so exploitation is not known to be occurring in the wild.
What to do: Upgrade MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later, as soon as patches can be scheduled. In the interim, apply least privilege: revoke or tightly restrict query-execution roles from untrusted or broad user populations, and avoid exposing MarkLogic query/application server ports to untrusted networks. Review audit logs for unexpected use of XQuery evaluation functions by low-privileged accounts as an indicator of attempted abuse.
Affected
| Progress MarkLogic Server | 12.x before 12.1.0 |
| Progress MarkLogic Server | 11.x before 11.3.7 |
Estimated exposure
niche≈ a few thousand enterprise deployments overall, with likely only hundreds of instances directly internet-exposed (clearly an estimate) — MarkLogic is a commercial enterprise NoSQL database typically deployed on-premises in government, healthcare, publishing, and financial organizations, and public scan engines historically show only a small number of directly exposed…
Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.