Riskcovery

CVE-2025-33014

IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

State
Published
Severity
5.4 Medium
Published
Jul 18, 2025
Updated
Aug 18, 2025
Reserved
Apr 15, 2025

Read the record on cve.org

Description

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nibm

Weaknesses

  • CWE-1022 Use of Web Link to Untrusted Target with window.opener Access

Affected Products

ProductVersions
Sterling B2B IntegratorIBM
  • 6.0.0.0 through 6.1.2.7Affected
  • 6.2.0.0 through 6.2.0.4Affected
Sterling File GatewayIBM
  • 6.0.0.0 through 6.1.2.7Affected
  • 6.2.0.0 through 6.2.0.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.