Out-of-Bounds Write in Progress MarkLogic Server

Executive Summary

This vulnerability is an out-of-bounds write issue in Progress MarkLogic Server versions before 12.1.0 and 11.3.7. It affects certain language-processing functions and allows a remote authenticated attacker to cause server instability or make limited changes to data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of Progress MarkLogic Server. If your system runs version 12.x before 12.1.0 or 11.x before 11.3.7, it is vulnerable. Use commands like 'rpm -qa | grep MarkLogic' or 'dpkg -l | grep MarkLogic' to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash the server or alter data, potentially disrupting services or corrupting information. Since it requires authentication, the risk is higher for systems with user access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized data modification or server instability. An attacker could exploit the out-of-bounds write to alter data, which may violate integrity requirements under these regulations. Additionally, server instability could disrupt access controls or logging mechanisms, further compromising compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Progress MarkLogic Server to version 12.1.0 or later if using 12.x, or to version 11.3.7 or later if using 11.x. This addresses the out-of-bounds write vulnerability in language-processing functionality.

Useful 0 Not Useful 0