Db2 Recovery Expert EUVD-2025-211063

Exploitation targets the Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 Web UI and requires a victim with an active trusted session to interact with attacker-supplied input (UI:R) - e.g., clicking a crafted link or loading a malicious page that reflects the injected JavaScript. No attacker authentication is needed (PR:N), but the dependency on user interaction, the restriction to this specific product/version, and the need for a logged-in operator whose session can be abused all limit realistic exploitation; impact is confined to the victim's browser session (credential/session disclosure), with no server-side availability impact.

This is a moderate-severity reflected cross-site scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a real-but-secondary priority rather than an urgent emergency: network attack vector and no required privileges lower the bar, but the mandatory user interaction (UI:R - a victim must open attacker-controlled input in the Web UI) and the low, browser-session-scoped confidentiality/integrity impact (C:L/I:L, A:N) cap the damage. No EPSS score was supplied, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and no proof-of-concept was referenced, so there is no public exploit identified at time of analysis - this is a vendor-reported (IBM) issue with a patch already available. Conflicting/missing data to note explicitly: EPSS is absent and cannot be used to gauge real-world exploitation likelihood; the input Tags include a 'Microsoft' vendor label that is incorrect for this IBM product and should be disregarded. Overall, treat as a standard patch-cycle item for the limited population of hosts running this niche IBM Db2 recovery tool, not a drop-everything priority.

An attacker crafts a malicious URL or input containing JavaScript targeting the Db2 Recovery Expert Web UI and lures an authenticated operator into opening it. When the victim's browser renders the reflected payload within their trusted session, the script executes and can exfiltrate session tokens or credentials. No proof-of-concept was referenced and the attack requires victim interaction, limiting opportunistic mass exploitation.