DB2 Recovery Expert EUVD-2025-211065

Exploitation targets the product's Web UI, which must be reachable by the attacker's payload and rendered by a victim. The description specifies the attacker embeds arbitrary JavaScript that executes 'within a trusted session,' meaning a logged-in user (typically a DBA/administrator) must be induced to trigger the reflected script - the required user interaction (UI:R) is the primary limiting factor. While the attacker themselves need not authenticate (PR:N), meaningful impact (credential/session disclosure) depends on a victim with an active authenticated session interacting with the malicious content. Limited to IBM DB2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2; no availability impact and only partial confidentiality/integrity impact apply.

This is a medium-severity reflected cross-site scripting flaw (CVSS 6.1, CWE-79) whose real-world priority is moderate-to-low. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N shows network reach and no authentication (PR:N), but exploitation is gated by required user interaction (UI:R) - a victim must click an attacker-crafted link or load attacker-influenced content, which is the single biggest limiting factor. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input, so there is no signal of active or probable exploitation; per the input this is 'no public exploit identified at time of analysis.' The scope-change (S:C) and low confidentiality/integrity impacts reflect classic session/credential-theft potential within a trusted session rather than direct server compromise (A:N, no availability impact). Net: a vendor-patched XSS in a specialized database-recovery tool - worth remediating via the available IBM patch, but not an emergency given the absence of exploitation evidence and the user-interaction requirement. No CVSS-versus-description conflict exists: the description ('embed arbitrary JavaScript in the Web UI,' 'within a trusted session') is fully consistent with the AV:N/UI:R/S:C/C:L/I:L vector.

An attacker crafts a URL or input containing malicious JavaScript that is reflected unmodified by the DB2 Recovery Expert Web UI, then lures an authenticated administrator into clicking it (satisfying the UI:R requirement). When the victim's browser renders the response, the script executes in their trusted session and can exfiltrate session tokens or credentials. No public exploit code was identified in the provided data.