IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 contain a CWE-209 vulnerability where detailed error messages expose sensitive information to remote attackers via the browser. This information disclosure could be leveraged to facilitate additional attacks on the affected system. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can remotely obtain sensitive information from error messages displayed in the browser. This information disclosure does not directly affect integrity or availability but may assist attackers in crafting further attacks against the system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed—check the IBM vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to error messages or disabling detailed error reporting in production environments to limit information exposure.