Security Bulletin: IBM Sterling B2B Integrator is vulnerable to Cross-Site Scripting (CVE-2022-34330)

Summary

IBM Sterling B2B Integrator has addressed the cross-site scripting vulnerability

Vulnerability Details

CVEID:CVE-2022-34330
**DESCRIPTION:**IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/229469 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

IT41715

| Apply 6.1.0.6, 6.1.1.3 or 6.1.2.1

The version 6.0.3.7, 6.1.0.6, 6.1.1.3 and 6.1.2.1 are available on Fix Central.

The container version of 6.1.2.1 is available in IBM Entitled Registry with following tags.

• cp.icr.io/cp/ibm-b2bi/b2bi:6.1.2.1 for IBM Sterling B2B Integrator
• cp.icr.io/cp/ibm-sfg/sfg:6.1.2.1 for IBM Sterling File Gateway

Workarounds and Mitigations

None