← CVE Radar
CVE-2023-43208NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
9.8 CRITICALEPSS 85.88%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Jun 10, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2023-43208
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Oct 26, 2023
- Last modified
- 2026-06-17 06:25 UTC
Affected Products
From NVD CPE configurations.
nextgenmirth connect1 version range
- before 4.4.1
References
- packetstormsecurity.com http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html
- horizon3.ai https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43208