Progress Software has disclosed 31 security flaws in MarkLogic Server, including five high-severity vulnerabilities.
Affected releases include MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0.
Patches have been available since September 10, and previous August updates do not provide protection.
Review upgrade notes and patch versions.
Fixes for all issues are available as of September 10, through MarkLogic versions 11.3.7 and 12.1.0. Although the fixes were released earlier, the company released details of the issues on October 12. According to the company's update, there is no evidence that any of these issues have been used in real attacks so far.
Which systems are affected?
The issue affects users of versions 11.x (before 11.3.7) and 12.x (before 12.1.0). It is important to note that if you have already applied the fixes released in August, they do not address the new issues. You should definitely proceed with the recent updates.
Why are the problems critical?
The five most serious issues allow someone who already has some level of access to the system to escalate their privileges dangerously. For example:
- They may allow the creation of a new administrator account that will remain active.
- They may allow the execution of commands with elevated privileges or access to databases beyond the limits set for each user.
Apart from these five, the remaining problems depend on specific settings, such as how the software is connected to cloud services or other external functions.
What administrators need to know
There are no alternative ways of protection for those who cannot upgrade their software immediately. Furthermore, upgrading to new versions brings about changes in the way the system operates. Specifically:
- The use of newer data transfer tools is required.
- Some old features that are now considered unsafe are being removed.
- The rules on which user can execute commands on the system are becoming stricter.
For this reason, it is recommended that administrators carefully review their settings before applying the update, as it may affect how older applications or code work.
Top comments (0)