Critical severity · published Oct 26, 2023
CVE-2023-43208
NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
RansomwareIn wildKEV
9.8
CVSS
85.4%
EPSS
Yes
On KEV
Description
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)85.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 20, 2024
Federal remediation dueJun 10, 2024
Ransomware campaign useKnown
Affected products
Which versions
MC
Mirth Connect · Nextgen
before 4.4.1 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43208
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43208
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.horizon3.ai
https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/
packetstormsecurity.com
http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html
More from Mirth Connect
9.8
CVE-2023-37679
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server