Progress discloses 31 MarkLogic flaws, including administrator takeover paths

Progress Software disclosed 31 MarkLogic Server vulnerabilities on October 12, including two that could let accounts with limited management privileges take administrator control. Five flaws were rated critical; each requires an existing privilege or a way to run code on the server. Fixes have been available since September 10 in versions 11.3.7 and 12.1.0. Releases 11.3.6 and 12.0.3, which fixed August's vulnerabilities, remain affected by the newly disclosed flaws. Upgrading can disrupt existing automation: the fixes remove several features and tighten privilege checks. The 12.x line has no patched 12.0 release, requiring migration to 12.1.0. Existing diagnostic logs retain old permissions until rotated or recreated, and the Kerberos fix requires a keytab to perform its new check.