EUVD-2026-77787
GHSA-g477-2735-hpx2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.
AnalysisAI
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 accept forged requests without adequate validation, letting a remote attacker ride an authenticated administrator's browser session to read and lightly modify data exposed through the Db2 Mirror interface. Exploitation requires the victim to be logged in and to interact with attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4), so this is a cross-site request forgery rather than a pre-authentication takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Db2 Mirror For I
View allOS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execut
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to r
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Langu
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed t
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attacke
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attacke
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensiti
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenti
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to cr
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated re
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today