CVE-2025-36134lowCWE-1275

CVE-2025-36134: low-severity vulnerability in IBM Sterling B2B Integrator

IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure

Published

Follow this CVE+ Monitor Sterling B2B Integrator+ Monitor Sterling File Gateway

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.3%
In short

IBM Sterling B2B Integrator and File Gateway have a cookie security flaw that could expose sensitive information. The cookie lacks proper protection settings, allowing attackers in certain scenarios to access data they shouldn't.

Technical detail

The affected versions (6.0.0.0-6.1.2.7, 6.2.0.0-6.2.0.5, 6.2.1.1) fail to set the SameSite attribute on a sensitive cookie, enabling potential cross-site request forgery (CSRF) or cross-site script inclusion attacks to leak session data. Exploitation requires user interaction in a cross-site context.

Summary generated and translated by AI from the official description.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
IBM · Sterling B2B IntegratorIBM · Sterling File Gateway
Related CVEs — IBM Sterling B2B Integrator

In the same product, most dangerous first.

CVE-2019-4728HIGHCVE-2019-4728EPSS 5.2%CVE-2018-1513MEDIUMCVE-2018-1513EPSS 2.9%CVE-2018-1563MEDIUMCVE-2018-1563EPSS 2.8%CVE-2019-4423MEDIUMCVE-2019-4423EPSS 2.7%CVE-2019-4043HIGHCVE-2019-4043EPSS 2.4%CVE-2017-1192—CVE-2017-1192EPSS 2.3%