Common Vulnerabilities and Exposures

Common Vulnerabilities and Exposures
Name	Common Vulnerabilities and Exposures
Abbreviation	CVE
Status	Active
Version	5.0
Organization	MITRE Corporation
Related standards	Common Vulnerability Scoring System, Common Weakness Enumeration
Website	https://cve.mitre.org/

Common Vulnerabilities and Exposures is a publicly available dictionary of standardized identifiers for known cybersecurity vulnerabilities and exposures. Managed by the MITRE Corporation with funding from the Cybersecurity and Infrastructure Security Agency within the United States Department of Homeland Security, it provides a common reference point for security tools, services, and databases. The system is foundational to global vulnerability management, enabling disparate organizations like the National Institute of Standards and Technology and vendors such as Microsoft and Red Hat to communicate about threats effectively.

Overview

The primary purpose of the system is to provide a unique, common identifier for each publicly known vulnerability, allowing for efficient data exchange across separate security databases and tools. This standardization is critical for enabling automated security scanning and for correlating information from diverse sources like the National Vulnerability Database, commercial products from Rapid7 or Tenable, and open-source projects. By assigning a standard identifier, it eliminates confusion caused by different names for the same issue used by organizations such as CERT Coordination Center or Open Source Security Foundation. The dictionary itself does not contain technical data, risk scores, or repair information; it serves as the fundamental naming baseline upon which other services are built.

History and development

The initiative was launched in 1999 by the MITRE Corporation to address the growing challenge of multiple, incompatible vulnerability names used across the industry and early public databases. Its creation was heavily influenced by the need for a shared language following high-profile incidents that exposed coordination gaps. Initial community adoption was driven by its inclusion in influential security tools and the endorsement of major entities like the SANS Institute. A significant evolution occurred when the National Institute of Standards and Technology adopted it as the basis for its National Vulnerability Database, cementing its role as a U.S. federal standard. Ongoing development is now overseen by the CVE Numbering Authority system, which decentralizes identifier assignment to qualified organizations worldwide.

Structure and identifiers

Each entry is designated by a CVE Identifier, formatted as "CVE-YYYY-NNNN...", where YYYY is the year of assignment and NNNN is a sequence number. The identifier is permanently associated with a specific, discrete cybersecurity issue documented in a brief, public description. The assignment process is governed by a published set of rules maintained by the MITRE Corporation, which define the scope of what constitutes a valid entry. A global federation of CNAs, including major technology firms like Google, Cisco, and Oracle, as well as national bodies like JPCERT/CC in Japan, are authorized to assign identifiers within their respective scopes. This structure ensures comprehensive coverage across different products and regions.

Usage and impact

The identifiers are ubiquitously used across the cybersecurity ecosystem. They are integrated into security advisories issued by companies like Apple Inc. and Adobe Inc., vulnerability scanners from Qualys and Nessus, and threat intelligence platforms. Security teams at organizations worldwide use them to track remediation efforts, prioritize patches, and configure intrusion detection systems from vendors like Palo Alto Networks. The standardization has dramatically improved the efficiency of vulnerability disclosure and coordination among entities like the Forum of Incident Response and Security Teams and CERTs. Its adoption is considered a cornerstone for modern practices in Security information and event management and regulatory compliance frameworks.

Related standards and initiatives

The system forms the core of a broader vulnerability management framework that includes several complementary standards. The Common Vulnerability Scoring System, maintained by the Forum of Incident Response and Security Teams, provides a standardized method for rating severity. The Common Weakness Enumeration, also managed by the MITRE Corporation, catalogs underlying software flaw types. The Security Content Automation Protocol, led by the National Institute of Standards and Technology, uses the identifiers to automate compliance checking. Other related efforts include the Open Vulnerability and Assessment Language and vendor-specific platforms like the Microsoft Security Response Center advisories, all of which rely on the common identifiers for interoperability.

Management and lifecycle

The lifecycle of an entry begins with its discovery and public disclosure, often through a researcher or a coordinated process with a CVE Numbering Authority. Once a number is reserved and assigned, the entry is published in the list on the official website. The record is then propagated to downstream databases like the National Vulnerability Database, which enriches it with severity scores, impact metrics, and references. Entries are not deleted or reused; they may be updated with additional references or have their descriptions revised for clarity, but the core identifier remains immutable. Long-term stewardship and policy development are managed by the MITRE Corporation with guidance from the broader community, including the CVE Board, which includes representatives from organizations like IBM and the Department of Defense.

Category:Computer security Category:Technical communication Category:Computer security standards