LiveActive security incident?Get immediate response
CVE Record

CVE-2020-4700: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allo...

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user belonging to a specific user group to create a user or group with administrative privileges. IBM X-Force ID: 187077.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-4700 is a privilege-escalation flaw in IBM Sterling B2B Integrator Standard Edition. An authenticated user in a specific user group could create an administrative user or group, potentially gaining control over sensitive B2B integration workflows and data exchanges.

Executive priority

Prioritize remediation where IBM Sterling handles regulated, financial, customer, or partner data. This is not proven exploited in the provided sources, but successful abuse could give an insider or compromised account administrative control over sensitive integration operations.

Technical view

Affected versions are IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5. The CVSS 3.0 score is 7.5. The issue requires network access, low privileges, high attack complexity, and no user interaction, with high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is likely limited to organizations running the affected IBM Sterling versions with authenticated users in the implicated user group. Internet exposure increases concern, but the sources do not identify exposed deployments or affected configurations beyond version range and group membership.

Exploitation context

The provided sources do not show active exploitation, and this CVE is not listed as KEV. IBM X-Force temporal data marks exploit maturity as unproven in the supplied CVSS vector, so treat exploitation evidence as incomplete rather than confirmed.

Researcher notes

The key uncertainty is the unnamed specific user group and exact fixed release details, which are not included in the supplied bundle. Validation should focus on affected version ranges, IBM advisory confirmation, privilege-bearing group membership, and evidence of unauthorized administrative object creation.

Mitigation direction

  • Inventory IBM Sterling B2B Integrator Standard Edition versions in production and disaster recovery environments.
  • Review IBM advisory guidance for the supported fix, upgrade, or maintenance package.
  • Restrict membership in user-management or privileged groups until remediation is complete.
  • Review recently created users and groups for unexpected administrative privileges.
  • Monitor administrative account creation and privilege changes for suspicious activity.

Validation and detection

  • Confirm deployed versions are outside the affected ranges or remediated per IBM guidance.
  • Audit group membership for users with account or group creation capability.
  • Check administrative users and groups for unauthorized or unexpected entries.
  • Review logs for user and group creation events by non-administrators.
  • Document compensating access controls if immediate remediation is delayed.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-4700 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/I:H/PR:L/A:H/C:H/AV:N/AC:H/UI:N/S:U/RC:C/E:U/RL:O

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.0HighCVSS:3.0/I:H/PR:L/A:H/C:H/AV:N/AC:H/UI:N/S:U/RC:C/E:U/RL:O1.65.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

7.5High
CVSS 3.0 vector shape for CVE-2020-4700Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/I:H/PR:L/A:H/C:H/AV:N/AC:H/UI:N/S:U/RC:C/E:U/RL:O

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMSterling B2B Integrator6.0.0.0, 5.2.0.0, 5.2.6.5, 6.0.3.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.