This vulnerability causes IBM Sterling B2B Integrator and IBM Sterling File Gateway to record potentially sensitive information in their log files, which can be read by users with privileged access. Although the data does not explode to the entire system, any privileged operator could review these logs to acquire confidential transaction details or credentials, compromising confidentiality of the information handled by the application.

The problem affects IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 as well as IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1.

The CVSS score of 4.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, further implying it is not actively exploited. The attack would likely require local or remote privileged access to the system; the description does not state a remote code execution or similar vector, so the risk is limited to privileged users who can read the log files. An attacker who gains privileged access could read the logs and obtain sensitive data, but no information about a broader remote exploitation pathway is provided.