This vulnerability, identified as a cross‑site scripting flaw, permits an authenticated user to inject arbitrary JavaScript into the Web UI. The injected code can alter the intended functionality of the portal and potentially exfiltrate session credentials or other sensitive data. The weakness is classified under CWE‑79, highlighting a failure of proper input validation and output encoding.

IBM Sterling B2B Integrator and IBM Sterling File Gateway are affected. The vulnerable versions span from 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0. These range include both standard enterprise releases and file gateway components as reflected in the listed CPE identifiers.

The CVSS score of 5.4 indicates a moderate severity. Exploitation probability, as per EPSS, is less than 1%, suggesting a low likelihood but not impossible, and the vulnerability is not currently catalogued in the KEV list. The attack vector is inferred to originate from within the authenticated Web UI; an attacker must first obtain valid credentials or leverage a compromised account. Once access is achieved, the flaw can be exploited without additional privileges, making the risk significant for organizations that have not timely applied the recommended patches.