CVE-2025-27902
6.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-1022
Impact
Remote attackers can trigger unauthorized browser actions or leak sensitive data if a logged-in user clicks a malicious link or visits a rigged site. Exploitation requires network access and user interaction.
Root cause
The application fails to restrict framing or securely reference external links, leaving it exposed to clickjacking or untrusted external redirects.
Affected systems
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Apply the remediation patch referenced in IBM Security Advisory 7290893. As an interim workaround, avoid navigating to unverified links from the admin interface and restrict untrusted outbound traffic from administrative workstations.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser