{"api_version":"1","generated_at":"2026-08-14T06:04:08+00:00","cve":"CVE-2025-36298","urls":{"html":"https://cve.report/CVE-2025-36298","api":"https://cve.report/api/cve/CVE-2025-36298.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-36298","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-36298"},"summary":{"title":"Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway","description":"IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics server component is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-07-30 15:16:22","updated_at":"2026-07-31 23:17:22"},"problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"5.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7280668","name":"https://www.ibm.com/support/pages/node/7280668","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-36298","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36298","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Sterling B2B Integrator","version":"affected 6.1.2.0 6.1.2.7_2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Sterling B2B Integrator","version":"affected 6.2.0.0 6.2.0.5_2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Sterling B2B Integrator","version":"affected 6.2.1.0 6.2.1.1_2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Sterling B2B Integrator","version":"affected 6.2.2.0 6.2.2.0_1 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Sterling File Gateway","version":"affected 6.1.2.0 6.1.2.7_2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Sterling File Gateway","version":"affected 6.2.0.0 6.2.0.5_2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Sterling File Gateway","version":"affected 6.2.1.0 6.2.1.1_2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Sterling File Gateway","version":"affected 6.2.2.0 6.2.2.0_1 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"ProductVersionAPARRemediation & FixIBM Sterling B2B Integrator and IBM Sterling File Gateway6.1.2.0 - 6.1.2.7_2 IT48302 Apply B2Bi 6.1.2.8, 6.2.0.6, 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.0.0 - 6.2.0.5_2 IT48302   Apply B2Bi 6.2.0.6, 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.1.0 - 6.2.1.1_2 IT48302   Apply B2Bi 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.2.0 - 6.2.2.0_1   IT48302  Apply B2Bi 6.2.2.1\n\n\n\n\n\n\n\nThe IIM versions of 6.1.2.8, 6.2.0.6, 6.2.1.2 and 6.2.2.1 are available on Fix Central http://www-933.ibm.com/support/fixcentral/swg/selectFixes . \n\n\n\nThe container version of 6.1.2.8, 6.2.0.6, 6.2.1.2 and 6.2.2.1 are available in IBM Entitled Registry.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"36298","cve":"CVE-2025-36298","epss":"0.001620000","percentile":"0.058270000","score_date":"2026-08-04","updated_at":"2026-08-05 00:03:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-36298","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-31T22:54:30.962525Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-31T22:54:44.854Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0_1:*:*:*:*:*:*:*"],"product":"Sterling B2B Integrator","vendor":"IBM","versions":[{"lessThanOrEqual":"6.1.2.7_2","status":"affected","version":"6.1.2.0","versionType":"semver"},{"lessThanOrEqual":"6.2.0.5_2","status":"affected","version":"6.2.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2.1.1_2","status":"affected","version":"6.2.1.0","versionType":"semver"},{"lessThanOrEqual":"6.2.2.0_1","status":"affected","version":"6.2.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:ibm:sterling_file_gateway:6.1.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_file_gateway:6.1.2.7_2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.5_2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.1_2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_file_gateway:6.2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:sterling_file_gateway:6.2.2.0_1:*:*:*:*:*:*:*"],"product":"Sterling File Gateway","vendor":"IBM","versions":[{"lessThanOrEqual":"6.1.2.7_2","status":"affected","version":"6.1.2.0","versionType":"semver"},{"lessThanOrEqual":"6.2.0.5_2","status":"affected","version":"6.2.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2.1.1_2","status":"affected","version":"6.2.1.0","versionType":"semver"},{"lessThanOrEqual":"6.2.2.0_1","status":"affected","version":"6.2.2.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics server component is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

"}],"value":"IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics server component is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-30T14:21:48.973Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7280668"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
ProductVersionAPARRemediation & Fix
IBM Sterling B2B Integrator and IBM Sterling File Gateway6.1.2.0 - 6.1.2.7_2 IT48302 Apply B2Bi 6.1.2.8, 6.2.0.6, 6.2.1.2, 6.2.2.1
IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.0.0 - 6.2.0.5_2 IT48302   Apply B2Bi 6.2.0.6, 6.2.1.2, 6.2.2.1
IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.1.0 - 6.2.1.1_2 IT48302   Apply B2Bi 6.2.1.2, 6.2.2.1
IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.2.0 - 6.2.2.0_1   IT48302  Apply B2Bi 6.2.2.1

The IIM versions of 6.1.2.8, 6.2.0.6, 6.2.1.2 and 6.2.2.1 are available on Fix Central. 

The container version of 6.1.2.8, 6.2.0.6, 6.2.1.2 and 6.2.2.1 are available in IBM Entitled Registry.

"}],"value":"ProductVersionAPARRemediation & FixIBM Sterling B2B Integrator and IBM Sterling File Gateway6.1.2.0 - 6.1.2.7_2 IT48302 Apply B2Bi 6.1.2.8, 6.2.0.6, 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.0.0 - 6.2.0.5_2 IT48302   Apply B2Bi 6.2.0.6, 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.1.0 - 6.2.1.1_2 IT48302   Apply B2Bi 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.2.0 - 6.2.2.0_1   IT48302  Apply B2Bi 6.2.2.1\n\n\n\n\n\n\n\nThe IIM versions of 6.1.2.8, 6.2.0.6, 6.2.1.2 and 6.2.2.1 are available on Fix Central http://www-933.ibm.com/support/fixcentral/swg/selectFixes . \n\n\n\nThe container version of 6.1.2.8, 6.2.0.6, 6.2.1.2 and 6.2.2.1 are available in IBM Entitled Registry."}],"title":"Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2025-36298","datePublished":"2026-07-30T14:21:48.973Z","dateReserved":"2025-04-15T21:16:48.650Z","dateUpdated":"2026-07-31T22:54:44.854Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-30 15:16:22","lastModifiedDate":"2026-07-31 23:17:22","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-31T22:54:30.962525Z","id":"CVE-2025-36298","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"36298","Ordinal":"1","Title":"Security Vulnerability in Ebics server affects IBM Sterling B2B ","CVE":"CVE-2025-36298","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"36298","Ordinal":"1","NoteData":"IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics server component is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","Type":"Description","Title":"Security Vulnerability in Ebics server affects IBM Sterling B2B "}]}}}