What is the CVSS score of CVE-2018-5921?

CVE-2018-5921 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

F2A70A Firmware CVE-2018-5921

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2018-10-03 hp-security-alert@hp.com

HP CSRF F2A70A Firmware F2A71A Firmware F2A67A Firmware B5L26A Firmware B5L39A Firmware C2S11A Firmware C2S11V Firmware C2S12A Firmware C2S12V Firmware L1H45A Firmware G1W46A Firmware G1W46V Firmware G1W47A Firmware G1W47V Firmware L3U44A Firmware E6B71A Firmware E6B73A Firmware K0Q14A Firmware K0Q15A Firmware K0Q17A Firmware K0Q18A Firmware M0P32A Firmware K0Q19A Firmware K0Q20A Firmware K0Q21A Firmware K0Q22A Firmware M0P33A Firmware M0P35A Firmware M0P36A Firmware M0P39A Firmware M0P40A Firmware H0Dc9A Firmware L8Z07A Firmware J7Z98A Firmware J7Z99A Firmware J8A04A Firmware J8A05A Firmware J8A06A Firmware L3U55A Firmware L3U56A Firmware L3U57A Firmware J7Z04A Firmware J7Z06A Firmware Cz244A Firmware A2W77A Firmware Cz245A Firmware A2W78A Firmware A2W79A Firmware D7P73A Firmware Cf116A Firmware Cf117A Firmware Cf118A Firmware L3U59A Firmware L3U60A F2A76A Firmware F2A77A Firmware F2A81A Firmware F2A78V Firmware F2A79A Firmware F2A80A Firmware Cd644A Firmware Cd645A Firmware Cd646A Firmware L3U46A Firmware L3U45A Firmware B5L46A Firmware B5L47A Firmware B5L48A Firmware B5L54A Firmware B5L49A Firmware B5L50A Firmware B5L04A Firmware B5L05A Firmware B5L06A Firmware B5L07A Firmware L3U40A Firmware L3U41A Firmware G1W39A Firmware G1W39V Firmware G1W40A Firmware G1W40V Firmware G1W41A Firmware G1W41V Firmware L3U42A Firmware L3U43A Firmware B3G85A Firmware J7X28A Firmware B3G84A Firmware P7Z47A Firmware B3G86A Firmware L3U61A Firmware L3U62A Firmware P7Z48A Firmware J8J64A Firmware J8J63A Firmware J8J65A Firmware J8J70A Firmware J8J71A Firmware J8J72A Firmware J8J76A Firmware J8J78A Firmware J8J66A Firmware J8J67A Firmware J8J73A Firmware J8J74A Firmware J8J79A Firmware J8J80A Firmware Cz248A Firmware Cz249A Firmware Cz250A Firmware Ca251A Firmware L3U47A Firmware L3U48A Firmware J8A10A Firmware J8A11A Firmware J8A12A Firmware J8A13A Firmware J8A17A Firmware J8A16A Firmware L3U67A Firmware L3U70A Firmware L3U66A Firmware L3U69A Firmware Cf066A Firmware Cf067A Firmware Cf068A Firmware Cf069A Firmware L3U63A Firmware L3U64A Firmware Cc522A Firmware Cc523A Firmware Cc524A Firmware L3U49A Firmware L3U50A Firmware Cf367A Firmware D7P68A Firmware L3U65A Firmware A2W76A Firmware A2W75A Firmware D7P70A Firmware D7P71A Firmware L3U51A Firmware L3U52A Firmware X3A69A Firmware X3A68A Firmware Z8Z19A Firmware Z8Z18A Firmware X3A72A Firmware X3A71A Firmware Z8Z21A Firmware Z8Z20A Firmware X3A79A Firmware Z8Z23A Firmware Z8Z22A Firmware X3A75A Firmware X3A74A Firmware X3A59A Firmware X3A60A Firmware Z8Z06A Firmware Z8Z07A Firmware X3A62A Firmware X3A63A Firmware Z8Z09A Firmware Z8Z08A Firmware X3A65A Firmware X3A66A Firmware Z8Z11A Firmware Z8Z10A Firmware X3A87A Firmware X3A86A Firmware Z8Z12A Firmware Z8Z13A Firmware X3A90A Firmware X3A89A Firmware Z8Z14A Firmware Z8Z15A Firmware X3A92A Firmware X3A93A Firmware Z8Z16A Firmware Z8Z17A Firmware X3A78A Firmware X3A77A Firmware Z8Z00A Firmware Z8Z01A Firmware X3A81A Firmware X3A80A Firmware Z8Z02A Firmware Z8Z03A Firmware X3A84A Firmware X3A83A Firmware Z8Z05A Firmware Z8Z04A Firmware L2762A Firmware L2683A Firmware

8.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 03, 2018 - 20:29 nvd

HIGH 8.8

DescriptionNVD

A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely to allow elevation of privilege.

AnalysisAI

A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely to allow elevation of privilege. Affected products include: Hp F2A70A Firmware, Hp F2A71A Firmware, Hp F2A67A Firmware, Hp B5L26A Firmware, Hp B5L39A Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.