CVE-2025-36298 is a CWE-79 cross-site scripting vulnerability in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway. It affects versions 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. The flaw allows an authenticated user to embed arbitrary JavaScript code in the web interface, which can alter intended functionality and potentially disclose credentials within a trusted session. The vulnerability requires low attack complexity but does require privileges and user interaction. No official patch or remediation level has been published by IBM at this time.

An authenticated user can exploit this vulnerability to inject malicious JavaScript into the web UI, potentially leading to unauthorized disclosure of credentials within the trusted session. This could compromise user accounts or session integrity. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, limit access to the affected versions to trusted users only and monitor for suspicious activity. Since the vulnerability requires authentication and user interaction, enforcing strong authentication and user training may reduce risk. No official fix or temporary workaround has been documented in the provided data.