A remote attacker can obtain sensitive data by triggering detailed technical error messages that the application returns in the browser. These error responses expose internal details such as stack traces or configuration information, which can be leveraged in subsequent attacks against the system. This weakness is a classic example of CWE‑209, where error handling inadvertently reveals confidential information.

Affected hardware and software include IBM Security Directory Integrator versions 7.2.0.0 through 7.2.0.14 and IBM Security Verify Directory Integrator versions 10.0.0.0 through 10.0.0.2. Organizations running any of these product releases are susceptible until the fix is applied.

The CVSS score of 5.3 indicates medium severity, but the lack of an EPSS score suggests that exploitation frequency is unknown. The vulnerability is listed as not in the CISA KEV catalog, implying no known public exploitation. The likely attack vector is remote, via a web request that causes the application to generate a technical error response. No special prerequisites are noted beyond the ability to trigger an error condition.