A flaw in the mailbox component of IBM Sterling B2B Integrator and IBM Sterling File Gateway exposes sensitive information because source‑code comments contain confidential data. This leads to a confidentiality breach where attackers can read data that should be protected. The weakness is captured by CWE-615, representing hard-coded credential and configuration information in source code comments.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in the following version ranges: 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 All affected installations must match one of these product lines.

The CVSS base score of 4.3 indicates moderate severity, while an EPSS score of less than 1% signals a very low probability of exploitation at this time. The weakness is not listed in the CISA KEV catalog. Likely exploitation would require a user to access the mailbox UI, which is typically available to authorized administrators; the attacker would then obtain hidden comments and read sensitive data. No public remote exploitation method is documented, so the risk is primarily confined to users interacting with the UI on the compromised system.