CVE-2025-33014 - IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

Back Back to CVE browser

MEDIUM

IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

Published Jul 18, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.21%

Description

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.

Affected products

Vendor IBM Product Sterling B2B Integrator Default
unaffected
- Version
  6.0.0.0
  Status
  affected
  Constraints
  <=6.1.2.7
- Version
  6.2.0.0
  Status
  affected
  Constraints
  <=6.2.0.4
Vendor IBM Product Sterling File Gateway Default
unaffected
- Version
  6.0.0.0
  Status
  affected
  Constraints
  <=6.1.2.7
- Version
  6.2.0.0
  Status
  affected
  Constraints
  <=6.2.0.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Sterling B2B Integrator

unaffected

Version	Status	Constraints
6.0.0.0	affected	<=6.1.2.7
6.2.0.0	affected	<=6.2.0.4

IBM

Sterling File Gateway

unaffected

Version	Status	Constraints
6.0.0.0	affected	<=6.1.2.7
6.2.0.0	affected	<=6.2.0.4

Remediation

Vendor solution

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 - 6.1.2.7 IT47893 Apply B2Bi 6.1.2.7_1. 6.2.0.5 or 6.2.1.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 - 6.2.0.4 IT47893 Apply B2Bi 6.2.0.5 or 6.2.1.0

The IIM versions of 6.1.2.7_1, 6.2.0.5 and 6.2.1.0 are available on Fix Central.

The container version of 6.1.2.7_1, 6.2.0.5 and 6.2.1.0 are available in IBM Entitled Registry.

Weaknesses (1)

CWE-1022