The vulnerability arises from improper validation of the HOST header in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6. An attacker who can send a crafted HTTP request may inject arbitrary header values, allowing cross‑site scripting, cache poisoning, or session hijacking. The impact is that an attacker could compromise the confidentiality or integrity of user sessions or inject malicious content into web responses.

IBM InfoSphere Information Server versions 11.7.0.0 to 11.7.1.6 are affected. Only these product builds expose the HTTP header validation flaw; earlier and later releases are not known to be vulnerable.

The CVSS score of 6.5 classifies the vulnerability as moderate severity. EPSS indicates less than 1% probability of exploitation, and the issue is not listed in the CISA KEV catalog. The exploitation requires the ability to send HTTP requests with custom Host headers to the vulnerable server, which is feasible for any actor with network reach to the target. While no public exploits are documented, the potential for XSS or session hijack makes it prudent to treat the vulnerability as a priority risk if the server is exposed.