A flaw in IBM Sterling B2B Integrator and IBM Sterling File Gateway allows an authenticated user to receive responses that expose sensitive host information. The exposed data does not provide direct remote code execution but could enable a malicious actor to gather system details and plan subsequent attacks. This vulnerability is identified as CWE‑201, Information Exposure.

IBM Sterling B2B Integrator and IBM Sterling File Gateway, specifically versions 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 are affected.

The CVSS score of 4.3 reflects moderate severity, and the EPSS rating of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack requires valid authentication to the system; an attacker who gains access can retrieve host data and potentially use it in further attacks, but no direct privilege escalation or code execution is possible at this stage.