{"id":"CVE-2018-2418","aliases":["EUVD-2018-14273","GHSA-rxg9-73c5-fc9f"],"status":"published","title":"SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can...","description":"SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0173,"percentile":0.77741,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2018-05-09T20:00:00Z","modified":"2026-06-17T01:55:40Z","products":[{"vendor":"sap","product":"maxdb_odbc_driver"},{"vendor":"sap se","product":"sap maxdb odbc driver"}],"references":[{"url":"https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2610231","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/104115","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2418"},{"url":"https://github.com/advisories/GHSA-rxg9-73c5-fc9f"}],"sources":{"cve":[{"id":"CVE-2018-2418","description":"SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.","status":"published","published":"2018-05-09T20:00:00Z","modified":"2024-08-05T04:21:33.28Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:04.911021Z"}],"euvd":[{"id":"EUVD-2018-14273","description":"SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.","status":"published","published":"2018-05-09T20:00:00Z","modified":"2024-08-05T04:21:33Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T02:40:16.309405Z"}],"ghsa":[{"id":"GHSA-rxg9-73c5-fc9f","title":"SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can...","description":"SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.","status":"published","published":"2022-05-13T01:32:22Z","modified":"2023-02-01T05:08:28Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:50:46.174982Z"}],"nvd":[{"id":"CVE-2018-2418","description":"SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.","status":"published","published":"2018-05-09T20:29:00.823Z","modified":"2026-06-17T01:55:40.05Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:04:26.098615Z"}]}}