CVE-2017-1348

Vulnerability

IBM Sterling B2B Integrator Standard Edition version 5.2 is vulnerable to a cross-site scripting (XSS) flaw, as described in the advisory [1]. The vulnerability resides in the Web UI and allows users to embed arbitrary JavaScript code. Affected versions include IBM Sterling B2B Integrator Standard Edition 5.2.

Exploitation

An authenticated user with low privileges can inject malicious JavaScript code into the Web UI. The attack requires user interaction, as the injected script executes in the context of a trusted session when a victim user views the crafted content. The CVSS vector indicates network-based exploitation with low complexity [1].

Impact

Successful exploitation could lead to credentials disclosure within the context of a trusted session. The attacker can alter intended functionality, potentially accessing sensitive information or performing actions on behalf of the victim, with low impact on confidentiality and integrity [1].

Mitigation

IBM has released a fix as part of a security bulletin [1]. Administrators should apply the latest patches as provided in the IBM support document. No workarounds are documented; upgrading to the fixed version is the recommended mitigation.