Listen to this Post
How the CVE Works
CVE-2025-1348 affects IBM Sterling B2B Integrator and Sterling File Gateway (versions 6.0.0.0–6.1.2.6 and 6.2.0.0–6.2.0.4). The vulnerability arises due to improper caching policies, allowing a local attacker to retrieve sensitive data from a user’s browser cache. When the application fails to enforce `Cache-Control` or `Pragma: no-cache` headers, cached session data (such as authentication tokens or transaction details) remains accessible post-logout, enabling unauthorized information disclosure.
DailyCVE Form
Platform: IBM Sterling B2B Integrator/File Gateway
Version: 6.0.0.0–6.1.2.6, 6.2.0.0–6.2.0.4
Vulnerability: Information Disclosure
Severity: Medium
Date: 07/25/2025
Prediction: Patch expected by 09/2025
What Undercode Say
Analytics:
curl -X GET http://target/endpoint -H "Cache-Control: no-store" grep -r "sensitive" /tmp/browser_cache/
Exploit:
1. Attacker accesses cached sessions via browser history.
- Extracts tokens/data using dev tools or disk analysis.
Protection:
- Apply IBM patches.
- Configure `Cache-Control: no-store` headers.
- Disable client-side caching for sensitive endpoints.
Impact:
- Unauthorized data access.
- Session hijacking risks.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
