Progress Patches 31 MarkLogic Flaws, Including Five Critical Bugs Tied to Delegated Admin Rights

Progress Software published details of 31 vulnerabilities in its MarkLogic Server database on October 12, and rated five of them critical. Two of the flaws could let an account that holds only some management privileges take administrator control of the server. Three of the critical flaws scored 9.9 out of 10 and the other two scored 9.6. In each case the attacker must already have a privilege or a way to run code on the server. Fixes have been available since September 10 in MarkLogic 11.3.7 and MarkLogic 12.1.0.

The new fixes matter even for organisations that patched recently. The updates for 10 MarkLogic flaws disclosed in August arrived in 11.3.6 and 12.0.3, and both of those releases are affected by the new flaws. There is no patched 12.0 release, so customers on that line must move to 12.1.0, which also adds new features. Progress's records do not say whether any of the 31 flaws have been used in attacks, and none was in CISA's Known Exploited Vulnerabilities catalog when The Hacker News checked on October 13. No workaround is listed for customers who cannot upgrade yet.

Progress's upgrade notes tell customers to review delegated forest and database privilege assignments before upgrading, and to audit the roles that hold xdmp-eval-in. Of the remaining flaws, 24 were rated high and two medium.