IBM Sterling B2B Integrator CVE-2025-36134

Exploitation requires a victim who already holds an authenticated Sterling B2B Integrator or Sterling File Gateway session, and that victim must be induced to interact with an attacker-controlled cross-origin context (e.g. visiting a malicious page) so the browser attaches the SameSite-unprotected sensitive cookie to cross-site requests. Limiting factors: the flaw is only meaningful against logged-in users, depends on browser cookie-handling behavior (modern browsers default to SameSite=Lax, which may partially mitigate), and does not grant integrity or availability impact. It affects versions 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.5, and 6.2.1.1; it is a web/cookie configuration weakness rather than a memory-safety bug, so no special server-side feature toggle is named in the advisory.

Signals converge on a genuine-but-moderate priority. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) scores HIGH on the strength of a network vector, low complexity, no privileges, and HIGH confidentiality impact. However, that vector is internally questionable for a CWE-1275 missing/insecure SameSite cookie flaw: SameSite protections only matter in a cross-site request context, which realistically requires a victim's browser to be driven to an attacker-controlled page - i.e. UI:R is more defensible than the stated UI:N, and the real exploitation path depends on an already-authenticated victim session, so the 'unauthenticated' (PR:N) framing describes the attacker but understates that a valid victim session must exist. Exploitation likelihood is LOW: EPSS is 0.05% (16th percentile), there is no CISA KEV listing (not actively exploited per available data), and no public exploit identified at time of analysis. The C:H rating is also optimistic for a single cookie-attribute weakness; impact depends on what the exposed cookie grants. Net: treat as a legitimate hardening fix to schedule in normal patch cycles rather than an emergency - the HIGH CVSS is driven by theoretical confidentiality exposure, not by evidence of real-world exploitation.

An attacker lures an authenticated Sterling B2B Integrator or File Gateway user to a malicious web page; because the sensitive cookie lacks a proper SameSite attribute, the victim's browser attaches it to attacker-initiated cross-site requests, allowing the attacker to leverage or infer the session/sensitive cookie value. No public exploit code is identified at time of analysis, and the attack hinges on the victim already holding a valid authenticated session and performing the cross-site interaction.