An information‑disclosure vulnerability exists in IBM Sterling B2B Integrator and IBM Sterling File Gateway releases 6.2.0.0 through 6.2.2.0_1. The flaw arises because sensitive data is inadvertently included in source‑code comments of a dashboard component. An attacker able to view those comments could obtain confidential configuration or credential information, potentially compromising system confidentiality. The weakness is catalogued as CWE‑615 and does not provide an execution path or privilege escalation; it is limited to disclosure of data already present in the code base.

Affected products are IBM Sterling B2B Integrator and IBM Sterling File Gateway. Vulnerable versions include 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 for both products. The PSI patches are available in Fix Central and the IBM Entitled Registry.

The CVSS score of 4.3 and an EPSS score of less than 1% indicate moderate severity with a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require access to the source code for the dashboard component, either through a developer environment or via a compromised workstation. No privileged elevation or remote execution is possible; the attack vector is inferred to be local or developer‑level access rather than external network exploitation.