PT-2017-12218 · Nextgen Healthcare+1 · Mirth Connect+1

Publicado 2017-07-31 · Atualizado 2017-08-15 · CVE-2017-11743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MEDHOST Connex (affected versions not specified)

Description The issue concerns a hard-coded Mirth Connect admin credential in MEDHOST Connex, which could allow an attacker to intercept sensitive patient information if they have knowledge of the credential and direct access to the Mirth Connect management console. The admin account password is hard-coded as $K8t1ng throughout the application and is the same across all installations. Customers cannot change the Mirth Connect admin account password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-11743

Produtos afetados

Medhost Connex

Mirth Connect

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-11743 · Nota de Segurança
• http://securityfocus.com/bid/100086 · Nota
• http://seclists.org/fulldisclosure/2017/Jul/75 · Nota