Progress MarkLogic Server versions 12.x prior to 12.1.0 and 11.x prior to 11.3.7 are configured to use cleartext for Amazon S3 connections by default. This weakness allows an attacker who can position themselves in the network path to intercept and read data or credentials flowing between MarkLogic and an S3 bucket. Because the data is transmitted without encryption, the confidentiality of stored objects, query results, or authentication tokens is jeopardized. The vulnerability is identified as CWE‑319, a problem of insecure transmission.

Affected vendors include Progress Software Corporation with its MarkLogic Server product. Impacted versions are all releases of the 12.x branch before 12.1.0 and of the 11.x branch before 11.3.7.

The vulnerability carries a CVSS score of 7.5, indicating a high severity. EPSS is not available, so the precise likelihood of exploitation is unknown, but the potential for interception is real in any environment that uses the default cleartext configuration. The issue is not listed in the CISA KEV catalog, yet the nature of the flaw suggests that attackers could gain valuable information if they can observe the network traffic. The likely attack vector is a network‑positioned attacker able to see or modify traffic between the MarkLogic Server and the Amazon S3 endpoint.