Improper Privilege Escalation in MarkLogic Server

Executive Summary

This is an improper privilege management vulnerability in Progress MarkLogic Server. It affects the SQL, SPARQL, and Optic REST query interfaces. An authenticated user with a low-privileged REST role can escalate their privileges to administrator level. This allows them to perform privileged operations and access unauthorized data.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking the MarkLogic Server version. Use the Admin Interface or run the command 'xdmp:version()' in the Query Console to verify if the installed version is below 11.3.6 or 12.0.3.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers with low-level access to gain full administrative control over the MarkLogic Server. This could lead to unauthorized data access, modification, or deletion, as well as the ability to execute privileged operations that could disrupt services or compromise sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions of MarkLogic Server may face legal penalties, reputational damage, or loss of certification if this vulnerability is exploited and sensitive data is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to MarkLogic Server version 11.3.6, 12.0.3, or later immediately. Review and restrict REST role permissions to prevent privilege escalation. Monitor for unauthorized access or privileged operations.

Useful 0 Not Useful 0