Rewterz Threat Advisory – Multiple IBM Sterling B2B Integrator Standard Edition Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2022-43920 CVSS:6.3

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could allow an authenticated user to gain privileges in a different group due to an access control vulnerability in the Sftp server adapter.

CVE-2022-34330 CVSS:6.1

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2022-22371 CVSS:5.5

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. 

CVE-2022-22352 CVSS:5.4

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. 

CVE-2022-22338 CVSS:6.3

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

CVE-2022-22337 CVSS:4.3

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user. 

CVE-2021-38928 CVSS:5.4

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. 

Impact

• Privilege Escalation
• Cross-Site Scripting
• Data Manipulation
• Information Disclosure
• Information Theft

Indicators Of Compromise

CVE

• CVE-2022-43920
• CVE-2022-34330
• CVE-2022-22371
• CVE-2022-22352
• CVE-2022-22338
• CVE-2022-22337
• CVE-2021-38928

Affected Vendors

IBM

Affected Products

• IBM Sterling B2B Integrator 6.0.0.0
• IBM Sterling B2B Integrator 6.0.3.6
• IBM Sterling B2B Integrator 6.1.0.0
• IBM Sterling B2B Integrator 6.1.1.0
• IBM Sterling B2B Integrator 6.1.2.0
• IBM Sterling B2B Integrator 6.1.1.2

Remediation

Refer to IBM Security Advisory for patch, upgrade or suggested workaround information.

CVE-2022-43920 

CVE-2022-34330 

CVE-2022-22371 

CVE-2022-22352 

CVE-2022-22338 

CVE-2022-22337 

CVE-2021-38928