Skip to main content

IBM Sterling B2B Integrator CVE-2026-3158

| EUVDEUVD-2026-50012 MEDIUM
Inclusion of Sensitive Information in Source Code Comments (CWE-615)
2026-07-28 psirt@us.ibm.com GHSA-87wx-qw35-2g7w
IBM Information Disclosure Sterling B2b Integrator Sterling File Gateway
4.3
CVSS 3.1 · Vendor: us
Share

Severity by source

Vendor (us) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
4.3 MEDIUM

Low‑privilege authenticated network access, no user interaction, and limited confidentiality impact match the advisory details.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorVendor: us

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
Analysis Generated
Jul 28, 2026 - 20:33 vuln.today

DescriptionCVE.org

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to an information disclosure due to sensitive information being included in the source code comments of a dashboard component.

AnalysisAI

Information disclosure in the dashboard component of IBM Sterling B2B Integrator and File Gateway 6.2.x allows low‑privileged authenticated users to view sensitive details embedded in source code comments. No active exploitation or public proof‑of‑concept code is known at this time; the advisory carries a CVSS base score of 4.3 and is categorized as low severity.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low‑privilege credentials
Exploit
Access the dashboard component’s source code (e.g., via DevTools)
Execution
Extract sensitive information from comments
Impact
Leverage disclosed data for lateral movement or further exploitation
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The user must have authenticated access to the dashboard at a low‑privilege level (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network‑exposed but authenticated attack surface with low complexity and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid low‑privileged account logs into the dashboard and examines the client‑side code (e.g., via browser developer tools). Sensitive information discovered in comments, such as internal paths or system identifiers, is then used to refine further attacks or escalate access.
Remediation Apply the vendor‑supplied fix referenced in IBM’s support article (https://www.ibm.com/support/pages/node/7280661). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sterling B2b Integrator

View all
CVE-2021-29903 CRITICAL
9.8 Oct 06

IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection. Rated critical seve
CVE-2021-29798 CRITICAL
9.8 Oct 06

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection. Rated critical seve
CVE-2012-5937 CRITICAL
9.3 Apr 12

Unspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3, Sterling Integrator 5.0 and 5.1, and

CVE-2021-20562 MEDIUM POC
5.4 Jul 27

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-s
CVE-2018-1513 MEDIUM POC
5.4 Jul 23

IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. Rated medium sev
CVE-2018-1563 MEDIUM POC
5.4 Jul 20

IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) is vulnerable to cross-site
CVE-2017-1174 HIGH
8.8 Aug 10

IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vu
CVE-2017-1347 HIGH
8.8 Jun 23

IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vu
CVE-2021-29837 HIGH
8.8 Oct 06

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which c
CVE-2020-4700 HIGH
8.8 Nov 16

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenti
CVE-2020-4655 HIGH
8.8 Nov 16

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL in
CVE-2019-4387 HIGH
8.8 Nov 26

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. Rated high severity

Same weakness CWE-615 – Inclusion of Sensitive Information in Source Code Comments

View all
CVE-2024-52298 HIGH POC
7.5
CVE-2026-3157 MEDIUM
4.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-3158 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy