The vulnerability involves manipulating JSON server responses from IBM InfoSphere Information Server, allowing unauthorized parties to receive data that should remain confidential. This results in a breach of confidentiality, exposing sensitive information processed by the server. The flaw is categorized under CWE‑319, indicating insecure transmission of information.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 on IBM AIX, Linux, or Windows are affected. The issue manifests when the server exposes JSON responses to external clients, regardless of the underlying operating system.

The CVSS score of 6.5 reflects moderate severity, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires remote network access to the server’s JSON API; no privileged escalation is necessary, but an attacker who can craft requests may view sensitive data.