The vulnerability originates from insufficient input validation, permitting an unauthenticated attacker to force the web server to return sensitive file contents. This results in remote disclosure of confidential data, compromising the system’s confidentiality. It is classified as CWE‑213 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

IBM Engineering Requirements Management DOORS Next 7.1 and 7.2 are affected. An attacker can exploit the flaw by issuing specially crafted requests to the J2EE web application hosted by these versions.

The CVSS score of 5.3 indicates a moderate risk. No EPSS score is available, but the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited exploitation in the wild. The attack requires network access to the web server and the ability to send a crafted request; it is a remote information‑disclosure vulnerability. Precautionary measures include patching, but additional access controls can reduce risk.