IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 has a cross‑site scripting flaw that lets an unauthenticated attacker insert arbitrary JavaScript into the web interface. When an authenticated user views the manipulated page, the malicious script can change the page behavior and potentially read session data, leading to credential disclosure within a trusted session.

IBM Db2 Recovery Expert for Linux, UNIX and Windows, version 5.5.0 IF 2.

The CVSS score of 6.1 classifies this as a medium‑severity vulnerability; the EPSS score is not available, suggesting no current measurements of exploitation probability, and it is not listed in CISA Key Exploited Vulnerabilities. Because the attacker does not need prior authentication and only requires access to the web UI, the likely attack vector is via the publicly exposed management interface. If the victim’s session is compromised, an attacker can inject scripts that read cookies or local storage enabling credential theft.