CVE-2025-27897: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM DB2 Recovery Expert for Linux, UNIX and Windows

CVE-2025-27897 is a cross-site scripting vulnerability (CWE-79) in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2. The vulnerability enables an unauthenticated attacker to embed arbitrary JavaScript code in the product's web UI, which can alter the intended functionality and may result in credential disclosure within a trusted session. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

An attacker can exploit this vulnerability remotely without authentication by injecting malicious scripts into the web interface. This could lead to unauthorized disclosure of credentials within a trusted session and manipulation of the web UI's intended behavior. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, users should exercise caution when accessing the web UI and consider restricting access to trusted users only.