IBM InfoSphere Information Server processes the query string of HTTP GET requests and, if it contains sensitive data, can expose that data to an attacker who controls a man‑in‑the‑middle position. The vulnerability allows the disclosure of confidential information, such as authentication tokens or other credentials, with no requirement for privileged access or code execution. The weakness corresponds to CWE‑598, Information Exposure Through Unencrypted Transmission.

This issue affects IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6, including the service pack 2 for 11.7.1.6. System administrators managing these deployments on IBM AIX, Linux, or Windows should verify whether their installation is within the affected range.

The CVSS base score of 3.1 indicates a low severity, and the EPSS score of less than 1 % shows a very low probability of exploitation, which is further mitigated by the requirement that an attacker already has network visibility to perform a man‑in‑the‑middle capture. The vulnerability is not listed in the CISA KEV catalog. Although the risk is low, the exposure of sensitive data can still impact confidentiality for affected users.