This vulnerability (CVE-2025-36298) involves improper neutralization of input during web page generation (CWE-79) in IBM Sterling B2B Integrator and IBM Sterling File Gateway's Ebics server component. Authenticated users can embed malicious JavaScript code into the web interface, which may alter intended functionality and lead to credential disclosure within the context of a trusted session. Affected versions include 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The vulnerability impacts confidentiality and integrity but not availability. There is no vendor advisory or patch information available at this time.

An authenticated attacker can inject arbitrary JavaScript code into the web UI, potentially altering the application's intended functionality. This may lead to the disclosure of user credentials within a trusted session, compromising confidentiality and integrity of user data. The vulnerability does not affect availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted authenticated users only and monitor for suspicious activity related to web UI interactions. Avoid granting unnecessary privileges to users to reduce risk.