CVE-2023-43208NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
Aktif olarak istismar ediliyor — NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 20.05.2024 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 10.06.2024.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://github.com/nextgenhealthcare/connect/wiki/4.4.1---What%27s-New ; https://nvd.nist.gov/vuln/detail/CVE-2023-43208
Açıklama
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| nextgen | mirth connect | < 4.4.1 |
Kaynaklar ve yamalar
- https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/ ExploitThird Party Advisory
- http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43208 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:nextgen:mirth_connect:*:*:*:*:*:*:*:*< 4.4.1