IBM EUVD-2025-208664

The CVSS 3.1 score of 5.4 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates moderate severity with network accessibility, low attack complexity, and low privilege requirement (authenticated user), though it requires user interaction (UI:R) to trigger. The scope change (S:C) reflects potential impact across security boundaries via JavaScript execution in an administrative session. However, the authentication requirement (PR:L) is a significant limiting factor—this is not an unauthenticated attack. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no active in-the-wild exploitation at the time of analysis. Real-world risk depends on internal threat model: in organizations with strict insider threat programs, this poses lower priority; in organizations with weak access controls or high insider risk, this is a more urgent concern. The UI interaction requirement also limits worm-like propagation, though a malicious authenticated user could craft links embedding XSS payloads to send to other administrators. The moderate CVSS score coupled with authentication requirements suggests this is lower priority than unauthenticated vulnerabilities, but should still be patched promptly given the critical nature of B2B integration infrastructure.

A malicious or compromised administrator with valid credentials logs into the IBM Sterling B2B Integrator Web UI and injects a malicious JavaScript payload into a form field that accepts user input (such as a configuration name, description, or integration profile field). The payload is stored in the application database without proper sanitization. When another administrator subsequently accesses the affected page, the JavaScript executes in their browser session with full access to the administrative UI, allowing the attacker to harvest the victim's session token, redirect them to a phishing page to steal credentials, or manipulate integration configurations to intercept sensitive B2B data in transit. The attack requires an initial authenticated foothold but can compromise multiple accounts through social engineering or crafted link distribution within the organization.