IBM Controller Disclosure Management version 1.0.0.0 contains a flaw that allows an attacker to retrieve sensitive EXIF metadata from images that are uploaded to the system. The vulnerability arises because the software fails to properly remove or anonymize sensitive information before storing the image, resulting in accidental storage of metadata that should not be exposed. This flaw directly compromises the confidentiality of data that may contain personal or operational details, and it is classified as CWE-212.

The affected product is IBM Controller Disclosure Management. Version 1.0.0.0 is vulnerable and has been superseded by version 1.0.1.0, which addresses the issue. The fix version is available for download from IBM support.

The CVSS score of 4.3 indicates a moderate level of technical impact, and the EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying it is not a known actively exploited weakness. Based on the description, the likely attack vector involves remote exploitation through the image upload interface, requiring only that the attacker have the ability to submit images to the system. Once the image is uploaded, the sensitive metadata can be retrieved from the stored file, potentially exposing personal or system information.