A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.
The flaw is a remote command execution vulnerability in NextGen Mirth Connect v4.3.0. An attacker who exploits it can execute arbitrary commands on the server hosting the affected Mirth Connect instance.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 9 months after disclosure. Public exploit code (Metasploit) appeared 3 months after disclosure.
- Disclosedday 0
- Public exploit codeMetasploit+3 mo
- First seen exploitedVulnCheck KEV evidence+9 mo
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family treeA fix was bypassed or incomplete once over 3 months.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- This CVECVE-2023-37679A remote command execution (RCE) vulnerability in NextGen Mirth…3 Aug 2023
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
- Stated in the CVE text
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 3 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.