Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-14T20:16:51.250Z",
  "pubdate": "2026-08-14T20:16:51.250Z",
  "executiveSummary": "IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary scripts within the context of the victim's browser session. This vulnerability poses a risk to the integrity and confidentiality of user sessions interacting with the affected database management and high-availability components.\nThe flaw stems from insufficient input validation and output encoding within the web-based interfaces or components of IBM Db2 Mirror for i. An attacker possessing valid authentication credentials can exploit this deficiency by injecting malicious scripts, typically JavaScript, into vulnerable input parameters or data fields that are subsequently rendered unsanitized to other users or administrators.\nSuccessful exploitation requires the attacker to have valid authentication credentials to the target system and relies on social engineering or standard user interaction, such as convincing a victim to navigate to a crafted URL or view a compromised interface component. Upon execution, the malicious script operates with the privileges of the victim's session, potentially leading to session hijacking, credential theft, or unauthorized modification of interface data.",
  "technicalDetails": "The vulnerability is classified as a cross-site scripting (XSS) flaw residing within the web management interfaces of IBM Db2 Mirror for i. The root cause is characterized by the application's failure to properly sanitize, filter, or encode user-supplied input before reflecting it back within Hypertext Markup Language (HTML) responses or executing it via Document Object Model (DOM) manipulation.\nThe affected software components include IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The attack vector is network-based, requiring the adversary to interact over HTTP or HTTPS protocols with the vulnerable web application endpoints exposed by the database high-availability framework.\nTo execute an attack, the authenticated adversary crafts a malicious payload containing executable script elements, such as <script> tags or event handlers like onload or onerror, embedded within input vectors processed by the application. When the application incorporates this unvalidated data directly into the generated web pages without appropriate context-aware output encoding (such as HTML entity encoding), the browser interprets the payload as legitimate code.\nThe attack flow proceeds as follows: First, the authenticated attacker submits the malicious payload to the vulnerable endpoint via HTTP requests. The backend application stores or immediately reflects the input without neutralization. Second, the victim user accesses the affected interface component where the payload is hosted or reflected. Third, the victim's web browser parses the response and executes the embedded script within the security context of the origin domain. Finally, the payload executes post-exploitation activities, which may include accessing session cookies, performing unauthorized actions on behalf of the user, exfiltrating sensitive data visible in the DOM, or redirecting the user to malicious external sites."
}