IBM DB2 Recovery Expert for Linux, Unix and Windows 5.5 IF 2 contains a web link that pulls data from an untrusted external site. The flaw allows a remote attacker to cause the victim web browser to expose sensitive data or perform unauthorized actions, effectively leaking confidential information or enabling browser‑based attacks. The weakness is classified as CWE‑1022.

The vulnerability affects IBM DB2 Recovery Expert for Linux, Unix and Windows version 5.5.0 IF 2. The application runs on Linux, Unix, and Windows platforms as specified by the CPE entries for those operating systems.

The CVSS score of 6.1 indicates a medium severity risk. EPSS data is not available, so the exploitation probability cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation. Based on the description, the likely attack vector is a remote attack that manipulates the web link to direct a victim browser to an external, potentially malicious site. Attackers could exploit this to gain access to privileged information or trigger unintended browser operations.