CVE-2025-36368

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36368", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:55.332Z", "datePublished": "2026-03-13T19:35:46.030Z", "dateUpdated": "2026-03-16T13:36:43.574Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:36:14.607Z"}, "title": "IBM Sterling B2B Integrator and IBM Sterling File Gateway SQL Injection", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Sterling B2B Integrator", "versions": [{"status": "affected", "version": "6.1.0.0", "lessThanOrEqual": "6.1.2.7_2", "versionType": "semver"}, {"status": "affected", "version": "6.2.0.0", "lessThanOrEqual": "6.2.0.5_1", "versionType": "semver"}, {"status": "affected", "version": "6.2.1.0", "lessThanOrEqual": "6.2.1.1_1", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_1:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263324", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "Remediation/Fixes Product Version APAR Remediation & Fix IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 - 6.1.2.7_2 IT48640 Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 - 6.2.0.5_1 IT48640 Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0 - 6.2.1.1_1 IT48640 Apply B2Bi 6.2.1.1_2 or 6.2.2.0 The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available on Fix Central . The container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available in IBM Entitled Registry.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Remediation/Fixes Product Version APAR Remediation &amp; Fix IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 - 6.1.2.7_2 IT48640 Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 - 6.2.0.5_1 IT48640 Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0 - 6.2.1.1_1 IT48640 Apply B2Bi 6.2.1.1_2 or 6.2.2.0 The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available on Fix Central . The container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available in IBM Entitled Registry.</p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T13:35:12.731590Z", "id": "CVE-2025-36368", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:36:43.574Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36368", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T13:35:12.731590Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:36:38.906Z"}}], "cna": {"title": "IBM Sterling B2B Integrator and IBM Sterling File Gateway SQL Injection", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Sterling B2B Integrator", "versions": [{"status": "affected", "version": "6.1.0.0", "versionType": "semver", "lessThanOrEqual": "6.1.2.7_2"}, {"status": "affected", "version": "6.2.0.0", "versionType": "semver", "lessThanOrEqual": "6.2.0.5_1"}, {"status": "affected", "version": "6.2.1.0", "versionType": "semver", "lessThanOrEqual": "6.2.1.1_1"}]}], "solutions": [{"lang": "en", "value": "Remediation/Fixes Product Version APAR Remediation & Fix IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 - 6.1.2.7_2 IT48640 Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 - 6.2.0.5_1 IT48640 Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0 - 6.2.1.1_1 IT48640 Apply B2Bi 6.2.1.1_2 or 6.2.2.0 The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available on Fix Central . The container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available in IBM Entitled Registry.", "supportingMedia": [{"type": "text/html", "value": "<p>Remediation/Fixes Product Version APAR Remediation &amp; Fix IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 - 6.1.2.7_2 IT48640 Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 - 6.2.0.5_1 IT48640 Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0 - 6.2.1.1_1 IT48640 Apply B2Bi 6.2.1.1_2 or 6.2.2.0 The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available on Fix Central . The container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0 are available in IBM Entitled Registry.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263324", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:36:14.607Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36368", "state": "PUBLISHED", "dateUpdated": "2026-03-16T13:36:43.574Z", "dateReserved": "2025-04-15T21:16:55.332Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-13T19:35:46.030Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_1:*:*:*:*:*:*:*"], "product": "Sterling B2B Integrator", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.1.2.7_2", "status": "affected", "version": "6.1.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.0.5_1", "status": "affected", "version": "6.2.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.1.1_1", "status": "affected", "version": "6.2.1.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF5BFBAA-B7B6-43FC-893D-F62E8AC28673", "versionEndExcluding": "6.1.2.8", "versionStartIncluding": "6.1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "0F026F01-EF66-4E43-A081-F1B2C7C87904", "versionEndExcluding": "6.2.0.5_2", "versionStartIncluding": "6.2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D31014C-F7D8-4B69-AB89-2A6AEAB7B667", "versionEndExcluding": "6.2.1.1_2", "versionStartIncluding": "6.2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "00C60634-AE0C-4641-B645-0D0511A0070C", "versionEndExcluding": "6.1.2.8", "versionStartIncluding": "6.1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "98CB35E7-789A-44B3-86E3-6F2A0CE56D4F", "versionEndExcluding": "6.2.0.5_2", "versionStartIncluding": "6.2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "4AD23AED-25F6-45AB-93DD-FC1864431290", "versionEndExcluding": "6.2.1.1_2", "versionStartIncluding": "6.2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database."}, {"lang": "es", "value": "IBM Sterling B2B Integrator e IBM Sterling File Gateway 6.1.0.0 hasta 6.1.2.7_2, 6.2.0.0 hasta 6.2.0.5_1, y 6.2.1.0 hasta 6.2.1.1_1 son vulnerables a inyecci\u00f3n SQL. Un usuario administrativo podr\u00eda enviar sentencias SQL especialmente dise\u00f1adas, lo que podr\u00eda permitir al atacante ver, a\u00f1adir, modificar o eliminar informaci\u00f3n en la base de datos de back-end."}], "id": "CVE-2025-36368", "lastModified": "2026-06-17T09:14:40.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36368", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T13:35:12.731590Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:53:50.813", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7263324"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1.0.0,6.1.2.7_2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.2.0.0,6.2.0.5_1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.2.1.0,6.2.1.1_1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Sterling B2B Integrator", "source": "cna", "vendor": "IBM"}, "product": "sterling_b2b_integrator", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-03-20T16:37:43.753424+00:00", "value": {"mitigation_remediation": ["Upgrade IBM Sterling B2B Integrator and IBM Sterling File Gateway to the latest releases (6.1.2.8, 6.2.0.5_2, 6.2.1.1_2, or 6.2.2.0) based on the affected version.", "If a version upgrade is not immediately possible, apply the IT48640 APAR remediation to the current installation.", "Verify that the applied fix has been installed correctly and consult IBM Fix Central or the provided support page for additional instructions."], "summary": {"action": "Apply Patch", "impact": "Data Compromise"}, "threat_synthesis": {"affected_systems": "Affected products include IBM Sterling B2B Integrator and IBM Sterling File Gateway. Vulnerable versions are 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1.", "description_and_impact": "IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to a SQL injection flaw that permits an administrative user to send crafted SQL statements. This flaw could enable the attacker to read, insert, modify, or delete data in the product\u2019s back\u2011end database, potentially exposing sensitive business information and corrupting service data.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw requires an administrative account to send malicious SQL, so the attacker must either compromise or have privileged credentials. If an internal threat is present or the system is exposed, the impact could be significant data loss or tampering. Prompt remediation is recommended to mitigate the risk."}}}}, "created": "2026-03-16T09:24:13.276562+00:00", "updated": "2026-03-23T13:40:10.519776+00:00", "vendors": ["ibm", "ibm$PRODUCT$sterling_b2b_integrator"]}