IBM Sterling Connect:Direct Web Services information disclosure

IBM Sterling Connect:Direct Web Services comes with default login credentials that attackers can use to access critical functions without authorization. This allows unauthorized access to potentially sensitive operations and data.

The vulnerability stems from hardcoded default credentials in IBM Sterling Connect:Direct Web Services versions 6.0-6.3, enabling unauthenticated or default-authenticated access to critical web service functions. An attacker can exploit this with minimal preconditions (network access to the web service) to gain unauthorized access to sensitive operations and information disclosure.