This vulnerability is a CSRF flaw in the administrative user interface of Progress MarkLogic Server prior to versions 11.3.6 and 12.0.3. An attacker can exploit this by luring an authenticated administrator to a crafted malicious web page, causing the administrator's browser to perform unauthorized administrative actions without their consent. The impact includes unauthorized modification of security settings on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to perform administrative actions on behalf of an authenticated administrator, potentially leading to unauthorized changes in security configurations. This can compromise the confidentiality, integrity, and availability of the affected MarkLogic Server instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted web content while authenticated to the MarkLogic Server Admin UI and consider additional CSRF protections or access restrictions where possible.