Overview
CVE-2025-36134 describes a low-severity security vulnerability affecting IBM Sterling B2B Integrator and IBM Sterling File Gateway. The vulnerability stems from a missing or insecure SameSite attribute for a sensitive cookie, potentially leading to sensitive information disclosure.
Technical Details
The core issue revolves around the absence or improper configuration of the SameSite attribute on a cookie used by IBM Sterling B2B Integrator and File Gateway. The SameSite attribute is a crucial security measure that controls whether a cookie is sent along with cross-site requests. Without a properly set SameSite attribute (or with it set to None without the Secure attribute), the cookie can be sent along with cross-site requests initiated from malicious websites. While the CVSS score is low, this can potentially expose sensitive information if the cookie contains sensitive data.
The affected versions are:
- IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7
- IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5
- IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.1
CVSS Analysis
- CVE ID: CVE-2025-36134
- Published: 2025-11-25T15:15:51.657
- Severity: LOW
- CVSS Score: 3.7
A CVSS score of 3.7 indicates a low severity. This is likely due to the requirement of specific circumstances (e.g., a user visiting a malicious site) and the potential limited impact of the information disclosure. However, even low-severity vulnerabilities should be addressed to minimize potential risks.
Possible Impact
The exploitation of this vulnerability could potentially lead to:
- Sensitive Information Disclosure: An attacker could potentially gain access to sensitive information contained within the cookie if a user visits a malicious website designed to exploit this flaw. The nature and sensitivity of the data contained in the cookie will determine the severity of the impact.
- Cross-Site Request Forgery (CSRF) Attacks: While not the primary risk, an improperly configured cookie *could* contribute to a CSRF attack in conjunction with other vulnerabilities.
Mitigation or Patch Steps
To mitigate this vulnerability, apply the recommended fix provided by IBM. This likely involves updating the configuration of IBM Sterling B2B Integrator and File Gateway to properly set the SameSite attribute on the affected cookie(s). Specifically, either set the SameSite attribute to Strict or Lax where appropriate. If SameSite=None is required, ensure the Secure attribute is also set to prevent the cookie from being sent over non-HTTPS connections.
Refer to the official IBM security bulletin for the specific patch or configuration instructions related to CVE-2025-36134. It’s recommended to test the fix in a non-production environment before applying it to a production system.
