IBM Concert Software versions 1.0 through 3.0.0 employ algorithms that are weaker than expected, allowing an attacker to potentially decrypt highly sensitive information. This weakness compromises the confidentiality of data stored or transmitted by the application and could lead to unauthorized access to protected content, violating privacy and regulatory requirements. The vulnerability is a cryptographic algorithm weakness classified as CWE-327.

All users of IBM Concert Software running versions 1.0 to 3.0.0 are affected. This includes any deployment that has not yet applied the recommended upgrade. IBM recommends addressing these vulnerabilities now by upgrading to IBM Concert Software 3.0.1.1, which replaces the weak cryptographic components.

The CVSS score of 3.7 denotes moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no current evidence of widespread exploitation. Based on the description, it is inferred that the attacker would need to compromise the system or application to leverage the weak algorithms, although the exact attack vector is not explicitly provided. The risk remains moderate until mitigated by the vendor’s recommendation of upgrading to 3.0.1.1.