{"id":"CVE-2023-43208","aliases":["EUVD-2023-47627","GHSA-pj5c-qr29-6746"],"status":"published","title":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote...","description":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.85886,"percentile":0.99732,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-502","CWE-78"],"published":"2023-10-26T00:00:00Z","modified":"2026-10-28T02:30:42Z","kev":{"date_added":"2024-05-20","due_date":"2024-06-10","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-05-20"},{"source":"kev","since":"2024-05-20"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/mirth_connect_cve_2023_43208","title":"Mirth Connect Deserialization RCE","type":"exploit","platform":"Linux,Unix,Windows","date":"2023-10-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/mirth_connect_cve_2023_43208"},{"source":"pocgithub","id":"jakabakos/CVE-2023-43208-mirth-connect-rce-poc","title":"jakabakos/CVE-2023-43208-mirth-connect-rce-poc","date":"2024-03-17","url":"https://github.com/jakabakos/CVE-2023-43208-mirth-connect-rce-poc"},{"source":"pocgithub","id":"J4F9S5D2Q7/CVE-2023-43208-MIRTHCONNECT","title":"J4F9S5D2Q7/CVE-2023-43208-MIRTHCONNECT","date":"2024-06-09","url":"https://github.com/J4F9S5D2Q7/CVE-2023-43208-MIRTHCONNECT"},{"source":"pocgithub","id":"Avento/CVE-2023-43208_Detection_PoC","title":"Avento/CVE-2023-43208_Detection_PoC","date":"2024-11-28","url":"https://github.com/Avento/CVE-2023-43208_Detection_PoC"},{"source":"pocgithub","id":"Pegasus0xx/CVE-2023-43208","title":"Pegasus0xx/CVE-2023-43208","date":"2026-02-22","url":"https://github.com/Pegasus0xx/CVE-2023-43208"},{"source":"pocgithub","id":"kyakei/CVE-2023-43208","title":"kyakei/CVE-2023-43208","date":"2026-02-22","url":"https://github.com/kyakei/CVE-2023-43208"},{"source":"pocgithub","id":"MKIRAHMET/PoC-2023-43208","title":"MKIRAHMET/PoC-2023-43208","date":"2026-02-24","url":"https://github.com/MKIRAHMET/PoC-2023-43208"},{"source":"pocgithub","id":"D3m0nicw0lf/CVE-2023-43208","title":"D3m0nicw0lf/CVE-2023-43208","date":"2026-02-25","url":"https://github.com/D3m0nicw0lf/CVE-2023-43208"},{"source":"pocgithub","id":"predyy/CVE-2023-43208","title":"predyy/CVE-2023-43208","date":"2026-02-25","url":"https://github.com/predyy/CVE-2023-43208"},{"source":"pocgithub","id":"azrvs/Mirth-Connect-CVE-2023-43208","title":"azrvs/Mirth-Connect-CVE-2023-43208","date":"2026-02-26","url":"https://github.com/azrvs/Mirth-Connect-CVE-2023-43208"},{"source":"pocgithub","id":"4nuxd/CVE-2023-43208","title":"4nuxd/CVE-2023-43208","date":"2026-03-12","url":"https://github.com/4nuxd/CVE-2023-43208"},{"source":"pocgithub","id":"LunaLynx12/cve-2023-43208-poc","title":"LunaLynx12/cve-2023-43208-poc","date":"2026-03-12","url":"https://github.com/LunaLynx12/cve-2023-43208-poc"},{"source":"pocgithub","id":"Criz117/CVE-2023-43208-PoC","title":"Criz117/CVE-2023-43208-PoC","date":"2026-03-13","url":"https://github.com/Criz117/CVE-2023-43208-PoC"},{"source":"pocgithub","id":"Humberto-pixel/CVE-2023-43208-PoC","title":"Humberto-pixel/CVE-2023-43208-PoC","date":"2026-03-28","url":"https://github.com/Humberto-pixel/CVE-2023-43208-PoC"},{"source":"nuclei","id":"CVE-2023-43208","title":"NextGen Healthcare Mirth Connect - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43208.yaml"}],"products":[{"vendor":"nextgen","product":"mirth_connect"},{"vendor":"nextgen healthcare","product":"mirth connect"}],"references":[{"url":"https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43208","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43208","tags":["advisory"]},{"url":"https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208"},{"url":"https://github.com/advisories/GHSA-pj5c-qr29-6746"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43208.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-43208","description":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","status":"published","published":"2023-10-26T00:00:00Z","modified":"2025-10-21T23:05:33.594Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78","CWE-502"],"updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-47627","description":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","status":"published","published":"2023-10-26T00:00:00Z","modified":"2025-10-21T23:05:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-05-20","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-pj5c-qr29-6746","title":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote...","description":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","status":"published","published":"2023-10-26T18:30:23Z","modified":"2025-10-22T00:32:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78","CWE-502"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2023-43208","title":"NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability","description":"NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.","cwes":["CWE-502"],"kev":{"date_added":"2024-05-20","due_date":"2024-06-10","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-43208","description":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","status":"published","published":"2023-10-26T17:15:09.033Z","modified":"2026-06-17T06:25:15.113Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78","CWE-502"],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"CVE-2023-43208","description":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","status":"published","published":"2023-10-26T00:00:00Z","modified":"2026-10-28T02:30:42.957388773Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:33.792101Z"}]}}