CVE-2023-27859 MEDIUM

CVE-2023-27859: IBM Db2 code execution

Vendor Ibm
Product Db2 for Linux, UNIX and Windows
Published January 22, 2024
Last update June 20, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file in another database. IBM X-Force ID: 249205.

Key dates

02Disclosure timeline

January 22, 2024 CVE published
June 20, 2025 Record updated