This vulnerability is a SQL injection flaw that allows a remote authenticated attacker to retrieve sensitive information from the database. The attacker can craft malicious input that is concatenated into SQL statements, enabling unauthorized data extraction. The impact is limited to confidentiality, as the flaw does not modify or delete data, nor does it provide execution privileges.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. These releases are used in both 10.x and 12.x lines of the IBM API Connect product suite.

The CVSS score of 7.7 indicates a high risk severity. The EPSS score is not available, but the lack of a KEV listing suggests no current large-scale exploitation. The likely attack vector is a remote authenticated attacker, meaning the attacker must first gain valid credentials to the API Connect platform. Once authenticated, the attacker can inject SQL statements via vulnerable input fields to read protected data.