CVE-2025-36431
Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in IBM Sterling B2B Integrator

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: IBM Corporation

Description
IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2025-36431
EUVD
EUVD-2025-210543

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm sterling_b2b_integrator From 6.2.2.0 (inc) to 6.2.2.0_1 (inc)
ibm sterling_file_gateway From 6.2.2.0 (inc) to 6.2.2.0_1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.2.0 through 6.2.2.0_1. An authenticated user can inject malicious JavaScript into the Web UI, which could alter functionality and potentially steal user credentials during a trusted session.

Detection Guidance

This vulnerability involves cross-site scripting (XSS) in IBM Sterling B2B Integrator and Sterling File Gateway. Detection requires manual inspection of the Web UI for suspicious JavaScript code or unusual input handling. No specific automated commands are provided in the context. Review application logs for unauthorized script execution or user-reported anomalies.

Impact Analysis

An attacker could exploit this to steal session cookies or credentials, leading to unauthorized access to sensitive data or systems. It may also allow attackers to perform actions on behalf of the victim within the application.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Apply the latest IBM Sterling B2B Integrator and Sterling File Gateway patches or updates to address the cross-site scripting vulnerability. Ensure all authenticated users follow secure coding practices and avoid embedding untrusted JavaScript in the Web UI.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-36431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart