IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 incorrectly records sensitive information in system log files. This flaw can lead to unintended disclosure of confidential data if the logs are accessed by unauthorized users, increasing the risk of data compromise. The vulnerability is a classic example of a logging weakness that violates confidentiality requirements and is classified under CWE-532.

The affected product is IBM InfoSphere Information Server, specifically versions 11.7.0.0 up to 11.7.1.6 inclusive. Users running any of these builds without the appropriate patch are at risk.

The CVSS base score of 4.3 indicates a low severity assessment. EPSS is below 1%, suggesting that exploitation is unlikely, and the vulnerability is not listed in CISA's KEV catalog. The most probable attack vector would involve an attacker gaining access to the application logs, either through local system compromise or by accessing shared log storage. No remote execution or privilege escalation is indicated, so the attack requires either local or vulnerable log access. Overall the risk is moderate but still actionable to prevent inadvertent data leakage.