IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information exposure vulnerability caused by overly verbose error messages. The weakness, classified as CWE‑209, allows an attacker to obtain sensitive system or configuration information that the correct application flow would not normally reveal, thereby potentially aiding further exploitation.

The vulnerability impacts IBM InfoSphere Information Server for all released versions from 11.7.0.0 up to and including 11.7.1.6, including both base releases and the 11.7.1.6 Service Pack 2 update.

The CVSS score is 4.3, indicating low to moderate severity, while the EPSS score is below 1 % and the vulnerability is not listed in CISA's KEV catalog, reducing the likelihood of widespread exploitation. The likely attack vector is through exposed error responses from the server when invalid inputs or commands are issued, which can display sensitive information to an attacker. As such, the risk is primarily limited to information disclosure rather than active compromise.