Read the docs
TI-2021-16371 Aliases CVE-2021-38928GHSA-2gmf-964r-8w6g

IBM Sterling B2B Integrator Standard Edition cross-origin resource sharing

Priority LOW 25Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 210323.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed Sterling B2B Integrator Standard Edition (IBM): 6.1.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMSterling B2B Integrator Standard Edition6.0.0.0 to before 6.1.2.16.1.2.1Patch availableCNA
  • Sterling B2B Integrator Standard Edition VendorIBM Affected 6.0.0.0 to before 6.1.2.1 Fixed in 6.1.2.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:standard:*:*:*6.0.0.0 to before 6.0.3.7; 6.1.0.0 to before 6.1.0.6; 6.1.1.0 to before 6.1.1.2VulnerableIBM
cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.0:*:*:*:standard:*:*:*6.1.2.0VulnerableIBM
  • cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:standard:*:*:* Versions 6.0.0.0 to before 6.0.3.7; 6.1.0.0 to before 6.1.0.6; 6.1.1.0 to before 6.1.1.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.0:*:*:*:standard:*:*:* Versions 6.1.2.0 Vulnerable ·IBM

Remediation

  • Fix · CNA Sterling B2B Integrator Standard Edition (IBM) Fixed in 6.1.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    IBM Sterling B2B Integrator Standard Edition 6.1.2.1

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2022-06666 IBM Sterling B2B Integrator Standard Edition SQL injectionPriority MEDIUM 43
    • TI-2022-21571 IBM Sterling B2B Integrator Standard Edition privilege escalationPriority LOW 39
    • TI-2022-06665 IBM Sterling B2B Integrator Standard Edition information disclosurePriority LOW 30
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38928
  2. 2026-10-03 Alias added: GHSA-2gmf-964r-8w6g

References

Advisory 1

  • TI-2015-06198 Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-03496 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime… CVSS 2.0HIGH 7.1
  • TI-2019-03450 Deserialization of untrusted data in IBM Sterling B2B Integrator CVSS 3.1HIGH 8.8
  • TI-2012-04950 Unspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3… CVSS 2.0HIGH 9.3
  • TI-2021-16494 SQL injection in IBM Sterling B2B Integrator CVSS 3.1CRITICAL 9.8
  • TI-2021-10535 SQL injection in IBM Sterling B2B Integrator CVSS 3.1CRITICAL 9.8
See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences