What is the CVSS score of CVE-2025-36298?

CVE-2025-36298 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-36298?

Yes, a patch is available for CVE-2025-36298. Update the affected software to the latest version immediately.

IBM Sterling B2B Integrator CVE-2025-36298

EUVD-2025-210542 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 ibm

GHSA-j82r-4qc9-cx6c

IBM XSS Sterling B2b Integrator Sterling File Gateway

5.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Authenticated low-privilege user required (PR:L), victim interaction needed (UI:R), injected script affects victim's browser scope (S:C); no availability impact from XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:36 vuln.today

DescriptionCVE.org

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics server component is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

AnalysisAI

Cross-site scripting in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privileged users to inject arbitrary JavaScript into the Web UI, executing in the browser context of other users within a trusted session. Both products across four version branches (6.1.2.x, 6.2.0.x, 6.2.1.x, and 6.2.2.0) are affected, with the primary risk being credential disclosure or session hijacking of higher-privileged users including administrators. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The affected component is the Ebics (Electronic Banking Internet Communication Standard) server, a protocol-level module used for secure, standardized file-based communication between enterprises and financial institutions - common in European banking ecosystems. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input processed by the Ebics component is insufficiently sanitized or encoded before being rendered into the Web UI, permitting script injection. The changed scope (S:C in the CVSS vector) reflects the canonical XSS threat model where injected code executes in a victim's browser context rather than the attacker's own session. Both IBM Sterling B2B Integrator (cpe:2.3:a:ibm:sterling_b2b_integrator) and IBM Sterling File Gateway (cpe:2.3:a:ibm:sterling_file_gateway) share the vulnerable Ebics server implementation across the affected version ranges, indicating a shared codebase or shared dependency.

RemediationAI

Apply the vendor-released patch documented in IBM's security advisory at https://www.ibm.com/support/pages/node/7280668. The advisory confirms patch availability but exact fixed build version numbers are not independently confirmed from the available intelligence - consult the advisory directly to identify the specific target build for each affected version branch. As an interim compensating control prior to patching, restrict user access to the Ebics server component within the Web UI to the smallest set of operationally required accounts, directly reducing the number of potential attackers who could inject content; note this may impact Ebics-dependent business workflows. Additionally, deploying or enforcing a Content Security Policy (CSP) header at the reverse proxy or load-balancer layer - prohibiting inline script execution - can substantially limit the impact of any XSS payload, though this may break existing UI functionality and requires testing before production deployment.