Mendix Studio ProのMCP脆弱性、修正版あり
Summary
Mendix Studio Proに内蔵のMCP Serverが、自分のPC内に限るはずの待ち受けをネットワーク側にも開いてしまう脆弱性です。Studio Pro 11を使う開発チームは、修正版への更新と、ポート7782の遮断状況の確認を進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Mendix Studio Proに内蔵のMCP Serverが、自分のPC内に限るはずの待ち受けをネットワーク側にも開いてしまう脆弱性です。Studio Pro 11を使う開発チームは、修正版への更新と、ポート7782の遮断状況の確認を進めてください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| SiemensMendix Studio Pro 11 |
≥ V11.15.0, < V11.16.0→ V11.16.0 |
V11.16.0 |
| SiemensMendix Studio Pro 11.12 |
≥ V11.12.6, < V11.12.7→ V11.12.7 |
V11.12.7 |
Original description The description as published by the source.
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web productcert@siemens.com
- web nvd.nist.gov
- web github.com