The flaw resides in the Query Console component of Progress MarkLogic Server, where the CSRF tokens are predictable. A remote attacker that lures an authenticated Query Console user to a malicious web page can cause the victim’s browser to submit requests that the server treats as legitimate. Because the requests execute with the victim’s permissions, the attacker can run arbitrary server‑side code and potentially manipulate data or breach confidentiality. The weakness is a classic CSRF flaw (CWE‑352).

MarkLogic Server from Progress Software is affected. Versions prior to 12.1.0 in the 12.x line and all 11.x releases older than 11.3.7 are vulnerable. No other versions or products were listed as impacted.

The CVSS score of 7.5 indicates a high severity vulnerability, and the EPSS score is not available so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated user and the victim to be tricked into visiting a malicious page, implying a social‑engineering or phishing component. Once the user’s session is co‑opted, the attacker can send requests that the server executes as that user, enabling a wide range of potential damage from data tampering to further lateral movement.