Progress MarkLogic Server versions prior to 12.1.0 and 11.3.7 contain a flaw in the Query Console file‑exploration endpoint that fails to properly sanitize input. This omission allows an attacker to perform HTTP response splitting by injecting arbitrary header fields or manipulating the response that the client receives. The result is unintended client‑side response handling that may alter the client’s interpretation of the data returned by the server.

Vendors affected are Progress Software Corporation with its MarkLogic Server product. The vulnerability applies to all 12.x releases older than 12.1.0 and all 11.x releases older than 11.3.7. Systems running those versions without the update are exposed.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting limited widespread exploitation at this time. Based on the description, it is inferred that the attacker must craft a request to the file‑exploration endpoint via HTTP to exploit the vulnerability. Attackers would need network access to the server’s HTTP interface and the ability to craft a request to the file‑exploration endpoint. Once the vulnerability is triggered, the attacker can alter response headers and manipulate the client’s interpretation of the response.