IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 store user credentials in plain text. This allows any local user with access to the file system to read stored passwords and other sensitive data, potentially enabling credential theft and impersonation of privileged users. The weakness is a plaintext storage of passwords, identified as CWE‑256.

Affected systems include IBM's InfoSphere Information Server product line, specifically version 11.7.0.0 up to and including 11.7.1.6. The vulnerability is relevant for installations on various operating systems such as AIX, Linux, and Windows, as indicated by the associated platform enumeration strings.

The vulnerability has a CVSS score of 7.1, indicating high impact. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local access; a non‑privileged user who can read the configuration files may obtain credential information. No remote exploitation path is disclosed, but the confidentiality of stored passwords is compromised for any local user.