Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-2694: IBM Sterling B2B Integrator and File Gateway: Cross-Site Scripting Can Steal Credentials

CVE-2025-2694 · published 1 year ago

Summary

If a hacker has access to a privileged user account, they can inject malicious code into the system's web interface, potentially allowing them to steal sensitive information, such as login credentials, from other trusted users. This vulnerability affects multiple versions of IBM Sterling B2B Integrator and File Gateway. To protect your system, apply the latest security patches as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	sterling_b2b_integrator	>= 6.0.0.0, < 6.1.2.7_2 >= 6.2.0.0, < 6.2.0.5 `cpe:2.3:a:ibm:sterling_b2b_integrator::::::::`
ibm	sterling_file_gateway	>= 6.0.0.0, < 6.1.2.7_2 >= 6.2.0.0, < 6.2.0.5 `cpe:2.3:a:ibm:sterling_file_gateway::::::::`

Original advisory text

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

References

https://www.ibm.com/support/pages/node/7244023 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published4 Sep 2025

Updated30 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-2694 · NVD

Track software like this

Free during beta