CVE-2025-2694
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Risk Assessment
A privileged user can execute malicious JavaScript in other users' browsers, potentially leading to credential theft or UI modification.
Recommendation
Update IBM Sterling B2B Integrator and IBM Sterling File Gateway to versions containing the fix. Implement input validation and limit user privileges.
Other vulnerabilities in IBM Sterling B2B Integrator / IBM Sterling File Gateway
See all- CVE-2026-7769High
IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- CVE-2025-36134Low
IBM Sterling B2B Integrator and IBM Sterling File Gateway could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. The issue affects versions 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.5, and 6.2.1.1.
Original NVD description (English source)
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS