The vulnerability is a classic cross‑site scripting flaw that enables an attacker to embed arbitrary JavaScript code in the web interface. This can alter normal UI behavior and may lead to the disclosure of credentials or other confidential data stored in a trusted session. The weakness is classified as CWE‑79.

IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.1.0.0 through 6.1.2.7_2 and 6.2.0.0 through 6.2.1.1_1 are affected by this flaw.

The vulnerability has a CVSS base score of 5.4, indicating moderate risk. EPSS scoring below 1% suggests exploitation is unlikely to be widespread, and it is not listed in the CISA KEV catalog. The likely attack vector involves the web UI, requiring an authenticated or compromised session to inject malicious script. Successful exploitation would grant an attacker the same privileges as the affected user, enabling credential theft or session hijacking. Given the low exploitable probability, monitoring for suspicious UI behavior is advised.