CVE-2025-27896: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM DB2 Recovery Expert for Linux, UNIX and Windows

CVE-2025-27896 is a cross-site scripting vulnerability (CWE-79) in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2. The vulnerability allows unauthenticated attackers to embed arbitrary JavaScript code in the web UI, which can alter application behavior and potentially disclose credentials during a trusted session. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can exploit this vulnerability remotely without authentication by injecting malicious scripts into the web interface. This may lead to unauthorized disclosure of credentials within a trusted session and manipulation of the application's intended functionality. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor IBM's official communications for updates. Until a fix is available, consider restricting access to the web UI to trusted users and networks to reduce exposure.