Db2 Recovery Expert EUVD-2025-211064

Exploitation targets the product's Web UI and requires an attacker to inject arbitrary JavaScript that a user then renders - per UI:R, a victim operator must open or interact with the crafted content for the payload to execute, so this is not automatable drive-by exploitation. No authentication is required of the attacker (PR:N), but the payoff (credential disclosure) depends on a legitimate user having an active, trusted session in the IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 Web UI. The limiting factors are the mandatory user interaction, the narrow deployment base of this recovery tooling, and the fact that only the specific affected version/interim-fix level is in scope.

This is a medium-severity reflected cross-site scripting flaw (CVSS 6.1) rather than a top-tier priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N shows network reach and low complexity with no privileges required, but exploitation hinges on user interaction (UI:R) - a victim must be lured into triggering the malicious payload - and impact is limited to low confidentiality and low integrity with no availability effect. The scope change (S:C) reflects that injected JavaScript executes in the victim's trusted browser session rather than the server's security context, consistent with the description's 'credentials disclosure within a trusted session.' No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or weaponization; the realistic risk is targeted social-engineering against operators of the Db2 Recovery Expert Web UI, not mass exploitation. The 'unauthenticated attacker' claim in the description aligns with PR:N in the vector, so it is consistent here, though the required user interaction and the product's niche footprint materially lower real-world urgency below what the 6.1 score alone might suggest.

An attacker crafts a URL or input containing malicious JavaScript targeting the Db2 Recovery Expert Web UI and delivers it to an authenticated operator via phishing or a malicious link. When the operator opens it within their trusted session, the script executes in their browser, enabling theft of session credentials or manipulation of the displayed interface. No public exploit code was identified at time of analysis, and the network-reachable, low-complexity injection still requires the victim to interact with the crafted content.