Description
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2026-10-12
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Credential Disclosure via XSS
Action: Immediate Patch
AI Analysis

Impact

IBM DB2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 contains a cross‑site scripting flaw that allows an unauthenticated attacker to inject arbitrary JavaScript code into the web user interface. The injected code can modify the intended functionality of the interface and can lead to disclosure of credentials that belong to a user who is already logged in, thereby compromising the integrity of trusted sessions.

Affected Systems

The vulnerability is present in IBM DB2 Recovery Expert for Linux, UNIX and Windows, particularly the 5.5 IF 2 release. All operating systems – Linux, UNIX and Windows – are affected. IBM recommends upgrading to version 12.1, which resolves the issue.

Risk and Exploitability

With a CVSS score of 6.1 the vulnerability is considered of moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote attacker accessing the publicly exposed web interface over HTTP or HTTPS; no additional privileges or credentials are required to exploit the flaw.

Generated by OpenCVE AI on October 12, 2026 at 20:28 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v12.1 available on  Passport Advantage https://www.ibm.com/software/passportadvantage

OpenCVE Recommended Actions

  • Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v12.1 as soon as possible
  • Restrict network access to the web UI so that only trusted internal hosts can reach it
  • Ensure that all user-supplied data is properly encoded before being rendered in the browser

Generated by OpenCVE AI on October 12, 2026 at 20:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Title DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting
First Time appeared Ibm
Ibm db2 Recovery Expert
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:windows:*:*
Vendors & Products Ibm
Ibm db2 Recovery Expert
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Db2 Recovery Expert
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:53:58.685Z

Reserved: 2025-03-10T17:14:03.089Z

Link: CVE-2025-27895

cve-icon Vulnrichment

Updated: 2026-10-12T22:52:19.154Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T20:17:04.353

Modified: 2026-10-24T20:10:00.137

Link: CVE-2025-27895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T21:15:07Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')