Vulnerability · Published Jun 20, 2024 · Assigned by VulDB

CVE-2024-6183EZ-Suite EZ-Partner Forgot Password cross site scripting

Medium 4.3

In plain English

A medium-severity security flaw in EZ-Partner from EZ-Suite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
EZ-Suite	EZ-Partner	5

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

VDB-269154 | EZ-Suite EZ-Partner Forgot Password cross site scripting vdb-entry
VDB-269154 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #353713 | EZ-Suite EZ-Partner 5 Injection third-party-advisory