CVE-2025-27902

Full vulnerability record from the local CVENow database.

Description

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

Severity

MEDIUM

CVSS score

6.1 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-12 20:17:05.407000

Last modified

2026-10-24 20:10:00.137000

View original CVE JSON

{
  "id": "CVE-2025-27902",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-12T20:17:05.407",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser"
    },
    {
      "lang": "es",
      "value": "IBM DB2 Recovery Expert para Linux, UNIX y Windows 5.5 IF 2 utiliza un enlace web con referencias no confiables a un sitio externo. Un atacante remoto podría explotar esta vulnerabilidad para exponer información sensible o realizar acciones no autorizadas en el navegador del víctima."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "DB2 Recovery Expert for Linux, UNIX and Windows",
          "cpes": [
            "cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:windows:*:*",
            "cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:linux:*:*",
            "cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:if2:*:*:*:unix:*:*"
          ],
          "versions": [
            {
              "version": "5.5 IF 2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-12T22:41:02.846878Z",
          "id": "CVE-2025-27902",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1022"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7290893",
      "source": "[email protected]"
    }
  ]
}