MarkLogic patch leaves delegated admins too much power
Progress published 31 MarkLogic Server flaws on October 12, including two critical issues that can let a delegated forest or database manager take administrator control of the server. Progress says fixes have been available since September 10 in MarkLogic 11.3.7 and 12.1.0.
The break is in the privilege model: a user with limited forest-scoped or database-scoped management rights can steer a forest attachment or related server action into full control, so the “partial admin” boundary does not hold the way operators may assume. Progress also says the August fixes for earlier MarkLogic bugs do not cover this new batch.
For shops that already installed the August releases, the exposure can still remain in the 11.x and 12.x lines if they sit on the older patched builds. The reporting does not show active exploitation, but the lasting issue is that delegated administration itself is part of the attack surface, not just the critical CVEs.
CVSS 9.8 CRITICAL: an authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3… EPSS 0.8% (57th percentile).
CVSS 9.9 CRITICAL: progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations.
CVSS 9.9 CRITICAL: progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path.
Progress Software: sanate vulnerabilità in MarkLogic Server
Rilasciati aggiornamenti di sicurezza per sanare 31 vulnerabilità, di cui 5 con gravità "critica" e 24 con gravità "alta", in Progress MarkLogic Server, nota piattaforma di database NoSQL progettata per archiviare, integrare, gestire e ricercare grandi volumi di dati eterogenei all'interno di un unico sistema.