PT-2017-12218 · Nextgen Healthcare+1 · Mirth Connect+1

Published 2017-07-31 · Updated 2017-08-15 · CVE-2017-11743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MEDHOST Connex (affected versions not specified)

Description The issue concerns a hard-coded Mirth Connect admin credential in MEDHOST Connex, which could allow an attacker to intercept sensitive patient information if they have knowledge of the credential and direct access to the Mirth Connect management console. The admin account password is hard-coded as $K8t1ng throughout the application and is the same across all installations. Customers cannot change the Mirth Connect admin account password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-11743

Affected Products

Medhost Connex

Mirth Connect

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-11743 · Security Note
• http://securityfocus.com/bid/100086 · Note
• http://seclists.org/fulldisclosure/2017/Jul/75 · Note