Critical Flaw in NextGen’s Mirth Connect Could Expose Healthcare Data

People of Mirth Connect, an open-supply info integration platform from NextGen Healthcare, are being urged to update to the latest model following the discovery of an unauthenticated remote code execution vulnerability.

Tracked as CVE-2023-43208, the vulnerability has been tackled in version 4.4.1 introduced on October 6, 2023.

“This is an easily exploitable, unauthenticated remote code execution vulnerability,” Horizon3.ai’s Naveen Sunkavally said in a Wednesday report. “Attackers would most probably exploit this vulnerability for initial obtain or to compromise sensitive health care data.”

Known as the “Swiss Military knife of health care integration,” Mirth Hook up is a cross-platform interface engine utilised in the health care field to connect and exchange facts involving disparate programs in a standardized fashion.

More technical details about the flaw have been withheld in light-weight of the simple fact that Mirth Hook up versions likely as far back as 2015/2016 have been discovered to be vulnerable to the issue.

It’s really worth noting that CVE-2023-43208 is a patch bypass for CVE-2023-37679 (CVSS score: 9.8), a critical remote command execution (RCE) vulnerability in the software program that makes it possible for attackers to execute arbitrary instructions on the hosting server.

Although CVE-2023-37679 was described by its maintainers as only influencing servers working Java 8, Horizon3.ai’s analysis found that all scenarios of Mirth Hook up, regardless of the Java edition, have been susceptible to the difficulty.

Supplied the ease with which the vulnerability can be trivially abused, coupled with the truth that the exploitation procedures are nicely acknowledged, it really is suggested to update Mirth Hook up, specially that are publicly accessible above the internet, to variation 4.4.1 as before long as attainable to mitigate opportunity threats.

Discovered this post exciting? Stick to us on Twitter  and LinkedIn to read extra exceptional material we put up.

Some parts of this article are sourced from:
thehackernews.com