CVE-2025-27895: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM DB2 Recovery Expert for Linux, UNIX and Windows

CVE-2025-27895 is a cross-site scripting vulnerability (CWE-79) in IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2. The vulnerability arises from improper neutralization of input during web page generation, enabling unauthenticated attackers to embed arbitrary JavaScript code in the product's web UI. This can alter the UI's behavior and potentially disclose credentials within a trusted session. The CVSS v3.1 base score is 6.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An unauthenticated attacker can inject malicious JavaScript into the web interface, which may lead to unauthorized disclosure of user credentials during a trusted session. This compromises confidentiality and integrity of the affected system's web UI interactions. There is no indication of impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should exercise caution with the web UI and consider restricting access to trusted users only. Monitor IBM's official advisories for updates on remediation.