IBM CVE-2023-40693

The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network-accessible attack surface with low complexity, but requires login privileges and user interaction, moderating the severity to 5.4 (Medium). The requirement for PR:L (Low Privilege) and UI:R (User Interaction Required) substantially reduces real-world exploitation probability compared to unauthenticated vulnerabilities. However, the S:C (Changed Scope) rating and potential for credential disclosure within trusted sessions elevates concern in enterprise B2B environments where Sterling products handle sensitive integration workflows. Without confirmed KEV status or public POC availability disclosed in typical sources, EPSS scoring would likely fall in the 15-25% range—indicating this is a legitimate security concern but not in the top tier of exploitation risk. Organizations should prioritize this based on network exposure and user privilege levels rather than treating it as an emergency.

An attacker with valid Sterling platform credentials crafts a malicious URL containing JavaScript payload in a parameter that the Web UI reflects without encoding (e.g., a search field or report parameter). The attacker sends this URL to a legitimate user via email or internal messaging. When the trusted user clicks the link while logged into Sterling, the JavaScript executes in their browser session, capturing session cookies or prompting the user to re-enter credentials on a fake login form. The attacker then uses the stolen session or credentials to access sensitive B2B integration data or workflows.