Múltiples vulnerabilidades en IBM Java SDK que afectan a Db2 Recovery Expert para Linux, Unix y Windows

A successful CSRF attack could allow an attacker to execute malicious and unauthorized actions within the context of a legitimate user's session. This could involve modifying recovery configurations, initiating unintended recovery operations, or potentially gaining access to sensitive data related to database recovery processes. The blast radius is limited to the scope of actions that can be performed through the DB2 Recovery Expert interface, but the impact on data integrity and availability could be significant if critical recovery procedures are manipulated. While not directly leading to remote code execution, a CSRF in a recovery tool could be leveraged to disrupt database operations and potentially cause data loss.

Organizations utilizing IBM DB2 Recovery Expert for LUW version 5.5 Interim Fix 002, particularly those with sensitive database environments or those who rely on the recovery tool for critical business operations, are at risk. Shared hosting environments where multiple users share the same DB2 Recovery Expert instance could also be vulnerable.

1. 2026-02-17Disclosure

   disclosure

1. Reservado2025-03-10
2. Publicada2026-02-17
3. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-27904 is to upgrade to IBM DB2 Recovery Expert for LUW version 5.5.1 or later. If an immediate upgrade is not feasible, consider implementing strict input validation and output encoding within the application to prevent malicious requests from being processed. Implementing a Content Security Policy (CSP) can also help mitigate CSRF attacks by restricting the sources from which scripts can be executed. Review and restrict user permissions within the DB2 Recovery Expert interface to limit the potential impact of a successful CSRF attack.