IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server‑side request forgery (SSRF). An authenticated attacker could instruct the server to send HTTP requests to arbitrary internal hosts, enabling the disclosure of network topology or facilitating further exploitation. This flaw allows the attacker to obtain sensitive information and potentially pivot within the network.

The vulnerability affects IBM InfoSphere Information Server product versions 11.7.0.0 to 11.7.1.6 on operating systems such as AIX, Linux, and Windows, as indicated by the CPE entries for those platforms.

The CVSS v3.1 score of 5.4 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require an authenticated session with sufficient privileges to trigger the SSRF endpoint; once the flaw is leveraged, the attacker can access internal resources and enumerate the network.