Critical Vulnerability Discovered in NextGen Healthcare Mirth Connect

What changed

NextGen Healthcare has revealed a significant vulnerability in its Mirth Connect software, specifically in versions prior to 4.4.1. This flaw stems from the incomplete patching of a previous vulnerability, CVE-2023-37679, which has led to concerns about the security of the platform.

The deserialization of untrusted data issue could allow attackers to execute arbitrary code remotely without authentication, posing a severe risk to users.

Who is affected

This vulnerability affects a broad range of users and organizations relying on Mirth Connect for healthcare data integration and management.

Affected entities include healthcare providers, data integrators, and any organization utilizing Mirth Connect for interoperability solutions.

• NextGen Healthcare Mirth Connect versions before 4.4.1
• Healthcare providers using Mirth Connect for data handling
• Organizations focused on healthcare data integration
• Developers and IT teams managing Mirth Connect instances

What to do

Organizations using Mirth Connect should prioritize upgrading to version 4.4.1 or later to mitigate the risks associated with this vulnerability.

Regular security assessments and monitoring should be conducted to identify any potential exploitation attempts.

• Update Mirth Connect to version 4.4.1 or higher immediately
• Conduct security audits to assess exposure to CVE-2023-37679
• Implement monitoring for unusual activities within the Mirth Connect environment