CVE-2025-36247

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
ibmCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Affected Products (NVD)
VendorProductVersion
ibmdb2
11.5.0 ≤
𝑥
≤ 11.5.9
ibmdb2
11.5.0 ≤
𝑥
≤ 11.5.9
ibmdb2
11.5.0 ≤
𝑥
≤ 11.5.9
ibmdb2
12.1.0 ≤
𝑥
≤ 12.1.3
ibmdb2
12.1.0 ≤
𝑥
≤ 12.1.3
ibmdb2
12.1.0 ≤
𝑥
≤ 12.1.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.ibm.com/support/pages/node/7259961