CVE-2025-33014mediumCWE-1022

CVE-2025-33014: medium-severity vulnerability in IBM Sterling B2B Integrator

IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

Published · Updated

Follow this CVE+ Monitor Sterling B2B Integrator+ Monitor Sterling File Gateway

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.3%
In short

IBM Sterling B2B Integrator and File Gateway contain a flaw where web links can point to untrusted external websites. An attacker could trick users into clicking these links to steal sensitive information or perform unwanted actions in their browsers.

Technical detail

CWE-1022 link injection vulnerability in IBM Sterling B2B Integrator and File Gateway (versions 6.0.0.0–6.1.2.7 and 6.2.0.0–6.2.0.4) allows remote attackers to inject malicious external links into the application interface. Exploitation requires user interaction (clicking the link) and can result in credential theft, unauthorized transactions, or information disclosure via the victim's authenticated session.

Summary generated and translated by AI from the official description.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
IBM · Sterling B2B IntegratorIBM · Sterling File Gateway
Related CVEs — IBM Sterling B2B Integrator

In the same product, most dangerous first.

CVE-2019-4728HIGHCVE-2019-4728EPSS 5.2%CVE-2018-1513MEDIUMCVE-2018-1513EPSS 2.9%CVE-2018-1563MEDIUMCVE-2018-1563EPSS 2.8%CVE-2019-4423MEDIUMCVE-2019-4423EPSS 2.7%CVE-2019-4043HIGHCVE-2019-4043EPSS 2.4%CVE-2017-1192—CVE-2017-1192EPSS 2.3%