An attacker may extract sensitive data from the query string of an HTTP GET request. The vulnerability does not require authentication and can be abused by intercepting traffic, allowing information disclosure, but does not enable code execution or denial of service.

IBM Sterling Partner Engagement Manager Essentials Edition and Standard Edition, versions 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2. The remediated releases are 6.2.3.6 and 6.2.4.3 for both editions.

The CVSS score of 3.1 indicates low severity, and a very low EPSS of under 1% suggests limited public exploitation. It is not listed in the CISA KEV catalog. The attack requires placing a man‑in‑the‑middle to capture unencrypted GET requests; no user interaction or privileged access is needed. While the risk is low, any exposed query data could be valuable to threat actors and should be addressed promptly.