InfoSecBulletin Cybersecurity for mankind
The US cybersecurity agency, CISA, added a flaw in NextGen Healthcare’s Mirth Connect product to its catalog of Known Exploited Vulnerabilities (KEV).
A vulnerability in the open source product, known as CVE-2023-43208, allows remote code execution without authentication due to a data deserialization problem. A patch was rolled out with the release of version 4.4.1.
338 fraudulent Olympics games ticketing websites
ASUS warn serious security vulnerability on 7 routers
AWS Announced New Malware Detection Tool For S3 Buckets
150,000 phones registered under one IMEI number in Bangladesh
CISA Releases Twenty Industrial Control Systems Advisories
Current web vulnerabilities in Bangladesh across vendor product line
Criminals impersonating CISA’s employees in phone calls
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Microsoft Tuesday fixes 51 flaws, 18 RCEs June 2024 Patch
Hackers breached 20,000 FortiGate systems worldwide: MIVD
In October 2023, cybersecurity company Horizon3.ai alerted healthcare companies about a flaw called CVE-2023-43208. It is a variation of another flaw called CVE-2023-37679, which was fixed in Mirth Connect version 4.4.0.
Horizon3.ai described the vulnerability as easily exploitable and warned that attackers would likely exploit it to gain access or compromise sensitive healthcare data.
The security firm identified over 1,200 cases of NextGen Mirth Connect exposed on the internet.
Horizon3.ai released technical details and proof-of-concept (PoC) code in mid-January 2024. Shortly after, The Shadowserver Foundation found over 440 internet-exposed instances affected by CVE-2023-43208.
CISA added CVE-2023-43208 to its catalog and told government agencies to fix it by June 10.
The agency has not provided any information about the attacks. Microsoft mentioned the exploitation of CVE-2023-37679 and CVE-2023-43208 in a brief report in April.
Microsoft reported that Mirth Connect and other vulnerabilities were exploited by a China-based threat actor known as Storm-1175, who has used Medusa ransomware.
CISA may know about other attacks, but their KEV catalog does not mention ransomware exploitation. The CVE-2023-37679 flaw has not been added to the catalog yet.
