Lucene search

IBM622EBE3F6C4F8AE72BB5131287BD08F25C480464555895C10BC73184B4B85409

HistoryJan 03, 2023 - 4:17 p.m.

Security Bulletin: B2B API of IBM Sterling B2B Integrator is vulnerable to Cross Origin Resource Sharing (CORS) (CVE-2021-38928)

2023-01-0316:17:05

www.ibm.com

ibm sterling b2b integrator

cross origin resource sharing

cve-2021-38928

vulnerability

fix

version 6.0.3.7

version 6.1.0.6

version 6.1.1.2

version 6.1.2.1

ibm entitled registry

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

20.2%

JSON

Summary

IBM Sterling B2B Integrator has addressed the Cross Origin Sharing vulnerability in B2B API

Vulnerability Details

CVEID:CVE-2021-38928
**DESCRIPTION:**IBM Sterling B2B Integrator Standard Edition uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/210323 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Sterling B2B Integrator	6.0.0.0 - 6.0.3.6
IBM Sterling B2B Integrator	6.1.0.0 - 6.1.0.5, 6…1.1.0 - 6.1.1.1, 6.1.2.0

Remediation/Fixes

Product	Version	APAR	Remediation & Fix
IBM Sterling B2B Integrator	6.0.0.0 - 6.0.3.6	IT41085	Apply 6.0.3.7
IBM Sterling B2B Integrator

6.1.0.0 - 6.1.0.5

6.1.1.0 - 6.1.1.1

6.1.2.0

IT41085

| Apply 6.1.0.6, 6.1.1.2 or 6.1.2.1

The version 6.0.3.7 , 6.1.0.6, 6.1.1.2 and 6.1.2.1 are available on Fix Central.

The container version of 6.1.2.1 is available in IBM Entitled Registry with following tags.

cp.icr.io/cp/ibm-b2bi/b2bi:6.1.2.1 for IBM Sterling B2B Integrator
cp.icr.io/cp/ibm-sfg/sfg:6.1.2.1 for IBM Sterling File Gateway

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsterling_b2b_integratorMatch6.0.0.0

ibmsterling_b2b_integratorMatch6.1.2.1

VendorProductVersionCPE
ibmsterling_b2b_integrator6.0.0.0cpe:2.3:a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:*:*:*:*
ibmsterling_b2b_integrator6.1.2.1cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	sterling_b2b_integrator	6.0.0.0	cpe:2.3:a:ibm:sterling_b2b_integrator:6.0.0.0:::::::*
ibm	sterling_b2b_integrator	6.1.2.1	cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.1:::::::*