CVE-2021-38928: IBM Sterling B2B Integrator Standard Edition cross-origin resource sharing
First published: Tue Dec 27 2022(Updated: )
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 210323.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Sterling B2B Integrator | >=6.0.0.0<6.0.3.7 | |
| IBM Sterling B2B Integrator | >=6.1.0.0<6.1.0.6 | |
| IBM Sterling B2B Integrator | >=6.1.1.0<6.1.1.2 | |
| IBM Sterling B2B Integrator | =6.1.2.0 | |
| IBM Sterling B2B Integrator | <=6.0.0.0 - 6.0.3.6 | |
| IBM Sterling B2B Integrator | <=6.1.0.0 - 6.1.0.5, 6..1.1.0 - 6.1.1.1, 6.1.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-38928.
How does IBM Sterling B2B Integrator Standard Edition use Cross-Origin Resource Sharing (CORS)?
IBM Sterling B2B Integrator Standard Edition uses Cross-Origin Resource Sharing (CORS) to allow requests from different domains.
What are the affected versions of IBM Sterling B2B Integrator Standard Edition?
The affected versions of IBM Sterling B2B Integrator Standard Edition are 6.0.0.0 through 6.0.3.7, 6.1.0.0 through 6.1.0.6, 6.1.1.0 through 6.1.1.2, and 6.1.2.0.
What could an attacker potentially do with this vulnerability?
An attacker could carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is medium with a CVSS score of 5.4.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/title
- agent/severity
- agent/tags
- agent/description
- agent/event
- vendor/ibm
- canonical/ibm sterling b2b integrator
- version/ibm sterling b2b integrator/6.0.0.0
- version/ibm sterling b2b integrator/6.1.0.0
- version/ibm sterling b2b integrator/6.1.1.0
- version/ibm sterling b2b integrator/6.1.2.0
- version/ibm sterling b2b integrator/6.0.0.0 - 6.0.3.6
- version/ibm sterling b2b integrator/6.1.0.0 - 6.1.0.5, 6..1.1.0 - 6.1.1.1, 6.1.2.0