The US cybersecurity agency, CISA, added a flaw in NextGen Healthcare’s Mirth Connect product to its catalog of Known Exploited Vulnerabilities (KEV).
A vulnerability in the open source product, known as CVE-2023-43208, allows remote code execution without authentication due to a data deserialization problem. A patch was rolled out with the release of version 4.4.1.
By infosecbulletin
/ Monday , June 24 2024
LockBit claimed that it breached Federal Reserve Board (Federalreserve.gov), the central banking system of the United States and exfiltrated 33...
Read More
By infosecbulletin
/ Monday , June 24 2024
Cyber attack compromised Indonesia's national data center, causing trouble with immigration checks at airports. Attacker demanded an $8 million ransom,...
Read More
By infosecbulletin
/ Sunday , June 23 2024
ESET Issued security patch for privilege escalation flaw in its Windows security products. This flaw, called CVE-2024-2003 (CVSS 7.3), was...
Read More
By infosecbulletin
/ Saturday , June 22 2024
A threat offer to sell a zero-day exploit for Atlassian's Jira in a underground forum. This exploit can be used...
Read More
By infosecbulletin
/ Friday , June 21 2024
The US plans to ban the sale of Kaspersky antivirus software due to its alleged ties to the Kremlin. Gina...
Read More
By infosecbulletin
/ Friday , June 21 2024
A group believed to be linked to China has hacked multiple telecom operators in an Asian country since 2021, according...
Read More
By infosecbulletin
/ Thursday , June 20 2024
Certified Information Systems Auditor (CISA) is a globally recognized professional certification for information systems audit, control, and security. It's offered...
Read More
By infosecbulletin
/ Thursday , June 20 2024
DataDog Security Labs found a worrying campaign targeting Amazon Web Services (AWS), showing a new wave of harmful activity aimed...
Read More
By infosecbulletin
/ Wednesday , June 19 2024
CISA and the FBI released guidance, Modern Approaches to Network Access Security, with support from other organizations including New Zealand’s...
Read More
By infosecbulletin
/ Tuesday , June 18 2024
On June 18, 2024, CISA released an advisory about Industrial Control Systems (ICS). These advisories give important information about security...
Read More
In October 2023, cybersecurity company Horizon3.ai alerted healthcare companies about a flaw called CVE-2023-43208. It is a variation of another flaw called CVE-2023-37679, which was fixed in Mirth Connect version 4.4.0.
Horizon3.ai described the vulnerability as easily exploitable and warned that attackers would likely exploit it to gain access or compromise sensitive healthcare data.
The security firm identified over 1,200 cases of NextGen Mirth Connect exposed on the internet.
Horizon3.ai released technical details and proof-of-concept (PoC) code in mid-January 2024. Shortly after, The Shadowserver Foundation found over 440 internet-exposed instances affected by CVE-2023-43208.
CISA added CVE-2023-43208 to its catalog and told government agencies to fix it by June 10.
The agency has not provided any information about the attacks. Microsoft mentioned the exploitation of CVE-2023-37679 and CVE-2023-43208 in a brief report in April.
Microsoft reported that Mirth Connect and other vulnerabilities were exploited by a China-based threat actor known as Storm-1175, who has used Medusa ransomware.
CISA may know about other attacks, but their KEV catalog does not mention ransomware exploitation. The CVE-2023-37679 flaw has not been added to the catalog yet.