CVE-2023-50316 is a medium severity SQL injection flaw (CVSS 6.3) in IBM Sterling B2B Integrator. A remote attacker with low privileges can send crafted SQL statements to view, add, modify or delete database content. IBM says to apply 6.1.2.6 or 6.2.0.3, and lists no workarounds.
What's affected
IBM's security bulletin lists IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 as affected. The remediation table points to APAR IT45596:
- For 6.0.0.0 through 6.1.2.5, apply B2BI 6.1.2.6 or 6.2.0.3.
- For 6.2.0.0 through 6.2.0.1, apply B2BI 6.2.0.3.
IBM says the IIM versions of 6.1.2.6 and 6.2.0.3 are on Fix Central, and the container versions are in the IBM Entitled Registry. The bulletin was first published on 14 November 2024.
How to check if you're exposed
Find the version of each Sterling B2B Integrator environment from the dashboard or from the installed product information, then compare it with the ranges above. Test, staging and disaster recovery copies count, because they hold real data in many shops.
For container installs, check which image tag your deployment uses and whether it is below 6.1.2.6 or 6.2.0.3.
The record scores the attack as needing low privileges, so list the accounts that can sign in to the product. Partner and service accounts deserve the closest look, since they are the ones attackers are most likely to obtain.
What to do now
- Record the version of every B2B Integrator environment.
- Download the fix for your line from Fix Central or the IBM Entitled Registry and plan a maintenance window.
- Back up the database before the upgrade, and test partner flows afterwards.
- Review the accounts with access and remove or restrict the ones that are unused.
- Check IBM's bulletin again before closing the work for any updated guidance.
Why it matters
SQL injection (CWE-89) happens when text supplied by a user is placed into a database query without being neutralised. The database cannot tell the difference between the intended query and the extra text, so the extra text changes what runs. IBM's description says an attacker could view, add, modify or delete information in the back end database.
B2B integration platforms sit between organisations and handle order, invoice and payment data. A change to that data can be both a security and a business problem, so even a medium score justifies a quick plan. The record shows a low impact rating on each of confidentiality, integrity and availability, and it requires a signed in account. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is there a workaround?
IBM lists none. The remedy is to apply 6.1.2.6 or 6.2.0.3.
Does an attacker need an account?
The record sets privileges required as low, so a signed in account is needed.
Sources
Last reviewed: 19 October 2026.
