IBM Concert Software versions 1.0.0 through 2.2.0 transmit data in clear text, allowing an attacker to capture confidential information if the network traffic is intercepted. This vulnerability can lead to confidentiality loss and potentially expose user credentials, configuration details, or other sensitive data. The weakness is classified as Cleartext Transmission of Sensitive Information (CWE-319).

The affected product is IBM Concert Software from IBM. Versions 1.0.0, 1.1.x to 2.2.0 are impacted, covering all releases between 1.0.0 and 2.2.0 inclusive.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a man‑in‑the‑middle scenario where an attacker positioned on the same network segment can intercept unencrypted traffic. Exploitation requires no special privileges; simply observing or replaying the traffic will reveal the sensitive data interned in the cleartext stream.