On Azure deployments, MarkLogic Server 12.x releases earlier than 12.1.0 and 11.x releases earlier than 11.3.7 may log security‑sensitive authentication information to diagnostic logs under certain configurations. An attacker who can read those logs could harvest credentials or tokens that allow unauthorized access to protected cloud resources. The vulnerability is a CWE‑532 flaw, where data is stored in a location that can be accessed by unintended parties.

MarkLogic Server from Progress Software is affected, specifically Azure deployments of 12.x prior to 12.1.0 and 11.x prior to 11.3.7. These versions are in use in Azure environments and any instance that records authentication data in diagnostic logs is considered vulnerable.

The CVSS score of 7.5 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, so exploit probability is uncertain but a potential exists. The attack vector is likely an adversary with access to the diagnostic logs, either through compromised accounts or misconfigured log sharing. By reading the logs, an attacker can obtain credentials or tokens that grant unauthorized access to protected resources.