Description
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2026-10-12
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

IBM Db2 Recovery Expert for Linux, Unix and Windows 5.5 IF 2 is affected by an unauthenticated cross‑site scripting flaw that allows an attacker to embed arbitrary JavaScript code into the Web UI. The injected scripts can modify the page behaviour and may capture credentials or other sensitive data from users operating within a trusted session. This CWE‑79 vulnerability can be exploited without needing to authenticate, making it a significant threat to the confidentiality of user credentials and the integrity of the web interface.

Affected Systems

The affected product is IBM Db2 Recovery Expert for Linux, Unix and Windows, specifically version 5.5 IF 2. No other versions are listed as impacted by this vulnerability.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated user accessing the vulnerable Web UI, which is commonly exposed to internal or public networks. The lack of authentication requirement means that any user that can reach the UI could potentially inject malicious scripts, leading to credential theft or session hijacking if the target user remains in.

Generated by OpenCVE AI on October 12, 2026 at 20:29 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v12.1 available on  Passport Advantage https://www.ibm.com/software/passportadvantage

OpenCVE Recommended Actions

  • Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v12.1, which contains the fix for this vulnerability.
  • If an upgrade is not immediately possible, restrict unauthenticated access to the Web UI or place the application behind a firewall that only allows trusted networks to reach it.
  • Apply a content‑security‑policy header that disallows inline scripts and restricts script sources to known safe origins to mitigate the impact of any remaining XSS payloads.

Generated by OpenCVE AI on October 12, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Title IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting
First Time appeared Ibm
Ibm db2 Recovery Expert
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:windows:*:*
Vendors & Products Ibm
Ibm db2 Recovery Expert
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Db2 Recovery Expert
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:53:58.821Z

Reserved: 2025-03-10T17:14:03.090Z

Link: CVE-2025-27896

cve-icon Vulnrichment

Updated: 2026-10-12T22:52:21.182Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T20:17:05.137

Modified: 2026-10-24T20:10:00.137

Link: CVE-2025-27896

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T21:15:07Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')