CVE-2025-36134
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
IBM Sterling B2B Integrator and IBM Sterling File Gateway could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. The issue affects versions 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.5, and 6.2.1.1.
Risk Assessment
A missing or insecure SameSite attribute may enable cross-site attacks and leakage of sensitive session information. The risk applies to B2B integration environments running vulnerable versions.
Recommendation
Update IBM Sterling B2B Integrator and IBM Sterling File Gateway to fixed versions. Verify the SameSite attribute configuration for sensitive cookies.
Other vulnerabilities in IBM Sterling B2B Integrator / IBM Sterling File Gateway
See all- CVE-2026-7769High
IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- CVE-2025-2694Medium
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Original NVD description (English source)
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS