The vulnerability exists in IBM Concert Software versions 1.0.0 through 2.2.0. A buffer is not properly cleared when resources are released, allowing an attacker to read private data from memory. This leads to disclosure of confidential information, reflecting the improper data sanitization weakness identified as CWE-14.

IBM’s Concert Software, specifically releases 1.0.0 and the 2.2.0 series, are affected. All older releases before 1.0.0 are unaffected, and the issue is fixed in version 2.3.1.

Based on the description, it is inferred that the attack vector is likely local or requires sufficient privileges to trigger the flaw while the application is running. The CVSS score of 6.2 denotes moderate severity. With an EPSS below 1% and no inclusion in the KEV catalog, the probability of exploitation remains low; however, the potential for sensitive data leakage warrants remediation. The flaw does not provide a documented remote execution path, but memory exposure during operation could compromise confidentiality for affected users.