The vulnerability allows a remote attacker to trigger requests that produce verbose error messages, revealing sensitive information such as system configuration or internal data. The impact is the exposure of confidential data that could be leveraged for more targeted attacks; however, it does not provide direct code execution or unauthorized access to system resources. The weakness is identified as CWE-209.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. This includes the product identifiers listed in the Common Platform Enumeration strings for IBM API Connect 10.0.8.0, 10.0.8.12, 12.1.0.0, and 12.1.1.2.

The CVSS score of 5.3 places the vulnerability in the moderate category, indicating a meaningful risk if not mitigated. The EPSS score is not available, so the current exploitation likelihood is uncertain. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack vector is remote, through the API Connect web or REST interface, whereby an attacker crafts a request that provokes a verbose error response.