CONNECT WITH US
Cyber Security

Cyber Security

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

The Hacker News logo

Published on

Add as a preferred source on Google
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.

Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.

MarkLogic 11.3 is the long-term support (LTS) line. The 12 line, which Progress calls an innovation release, has no patched 12.0 release. Its fix is 12.1.0, which also adds new features.

Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough. Those fixes arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws.

Progress's CVE records and its upgrade notes for the two releases do not say whether any of the 31 flaws has been used in attacks. None was in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog when The Hacker News checked on October 13.

The same records and notes list no workaround for customers who cannot upgrade yet.

Progress scored three of the five critical flaws 9.9 out of 10 on the CVSS scale and the other two 9.6. For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.

Two of them involve forests. In MarkLogic, a forest is a collection of documents that is attached to a database.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.