CVE-2025-36135
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to cross-site scripting. An authenticated user can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
Risk Assessment
An authenticated attacker could execute script in another user's browser, capture session or credentials, and gain unauthorized access to the integration system.
Recommendation
Update IBM Sterling B2B Integrator and IBM Sterling File Gateway to versions containing the fix (outside the listed version ranges) and enforce input validation in the Web UI.
Other vulnerabilities in IBM Sterling B2B Integrator
See all- CVE-2017-1192High
IBM Sterling B2B Integrator version 5.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources.
- CVE-2015-7410High
The Health Check tool in IBM Sterling B2B Integrator 5.2 does not properly use cookies in conjunction with HTTPS sessions, allowing man-in-the-middle attackers to obtain sensitive information or modify data.
- CVE-2025-36431Medium
An XSS vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.2.0 through 6.2.2.0_1) allows an authenticated user to embed arbitrary JavaScript code in the Web UI. This could lead to credential disclosure within a trusted session.
- CVE-2025-36298Medium
An XSS vulnerability in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway (multiple versions) allows an authenticated user to embed arbitrary JavaScript code in the Web UI. This could lead to credential disclosure within a trusted session.
- CVE-2026-3158Medium
IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to information disclosure due to sensitive information being included in the source code comments of a dashboard component.
- CVE-2026-3157Medium
IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to information disclosure due to sensitive information being included in the source code comments of a mailbox component.
- CVE-2026-1918Medium
IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions store potentially sensitive information in log files that could be read by a privileged user.
- CVE-2026-7362Medium
IBM Sterling B2B Integrator and IBM Sterling File Gateway in specified versions allow an authenticated user to obtain sensitive information that should only be available to a privileged user.
- CVE-2026-7775Medium
IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to stored cross-site scripting. A privileged user can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-3482Medium
IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request.
Original NVD description (English source)
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS