CVE-2025-27902
Received Received - Intake

IBM DB2 Recovery Expert Untrusted Link Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2025-27902
EUVD
EUVD-2025-211062

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1022 The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM DB2 Recovery Expert 5.5 IF 2 uses a web link that points to an untrusted external site. This could allow a remote attacker to trick users into visiting the link, potentially exposing sensitive information or performing unauthorized actions in the victim's web browser.

Detection Guidance

This vulnerability involves untrusted external links in IBM DB2 Recovery Expert. Detection requires checking web application configurations and network traffic for suspicious external references. Review IBM DB2 Recovery Expert logs and browser security settings for unauthorized external site interactions.

Impact Analysis

If you use IBM DB2 Recovery Expert 5.5 IF 2, an attacker could exploit this to steal sensitive data from your browser, modify browser settings, or perform actions on your behalf without your consent. This could lead to data breaches or unauthorized access to your systems.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate GDPR (data protection) and HIPAA (healthcare data privacy) requirements. Organizations using this software may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Apply the latest IBM DB2 Recovery Expert update to remove untrusted external references in web links. Disable or restrict access to the affected web interface until patched. Monitor network traffic for suspicious browser requests to external sites.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-27902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart