{"api_version":"1","generated_at":"2026-07-25T02:20:51+00:00","cve":"CVE-2021-38928","urls":{"html":"https://cve.report/CVE-2021-38928","api":"https://cve.report/api/cve/CVE-2021-38928.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-38928","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-38928"},"summary":{"title":"CVE-2021-38928","description":"IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 210323.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2023-01-04 18:15:00","updated_at":"2023-11-07 03:37:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/210323","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/210323","refsource":"MISC","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.ibm.com/support/pages/node/6852467","name":"https://www.ibm.com/support/pages/node/6852467","refsource":"MISC","tags":[],"title":"Security Bulletin: B2B API of IBM Sterling B2B Integrator is vulnerable to Cross Origin Resource Sharing (CORS) (CVE-2021-38928)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38928","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38928","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"38928","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"sterling_b2b_integrator","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"standard","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"38928","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"sterling_b2b_integrator","cpe6":"6.1.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"standard","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2021-38928","ASSIGNER":"psirt@us.ibm.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 210323."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"942 Overly Permissive Cross-domain Whitelist"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"IBM","product":{"product_data":[{"product_name":"Sterling B2B Integrator Standard Edition","version":{"version_data":[{"version_value":"6.0.0.0","version_affected":"="}]}}]}}]}},"references":{"reference_data":[{"url":"https://www.ibm.com/support/pages/node/6852467","refsource":"MISC","name":"https://www.ibm.com/support/pages/node/6852467"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/210323","refsource":"MISC","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/210323"}]},"generator":{"engine":"Vulnogram 0.1.0-dev"},"source":{"discovery":"UNKNOWN"},"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}]}},"nvd":{"publishedDate":"2023-01-04 18:15:00","lastModifiedDate":"2023-11-07 03:37:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.5}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:standard:*:*:*","versionStartIncluding":"6.1.1.0","versionEndExcluding":"6.1.1.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.0:*:*:*:standard:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:standard:*:*:*","versionStartIncluding":"6.1.0.0","versionEndExcluding":"6.1.0.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:standard:*:*:*","versionStartIncluding":"6.0.0.0","versionEndExcluding":"6.0.3.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"38928","Ordinal":"214606","Title":"CVE-2021-38928","CVE":"CVE-2021-38928","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"38928","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}