Common Vulnerabilities and Exposures

Common Vulnerabilities and Exposures
Name	Common Vulnerabilities and Exposures
Developer	MITRE Corporation
Released	1999
Latest release	ongoing
Platform	Cross-platform
License	Public domain assignments

Contents

Common Vulnerabilities and Exposures

Common Vulnerabilities and Exposures is a standardized cataloguing system for publicly disclosed cybersecurity vulnerabilities and exposures. It provides unique identifiers used by organizations such as the National Institute of Standards and Technology, Microsoft, Google, Apple Inc., and Cisco Systems to coordinate advisories, tools, and mitigations. The list underpins vulnerability management programs at institutions including Department of Homeland Security, United States Computer Emergency Readiness Team, European Union Agency for Cybersecurity, and private responders like CrowdStrike and FireEye.

Overview

The system assigns persistent identifiers to entries that describe specific software flaws reported by sources such as CERT Coordination Center, Open Web Application Security Project, Linux Foundation, Apache Software Foundation, and vendors like Oracle Corporation and IBM. Products affected include offerings from Red Hat, Canonical (company), VMware, Palantir Technologies, SAP SE, and Adobe Systems. Security tools from Tenable, Inc., Qualys, Rapid7, and Splunk ingest these identifiers for vulnerability scanning, patching workflows, and incident response practiced by teams at Amazon Web Services, Microsoft Azure, Google Cloud Platform, and Alibaba Cloud.

The naming scheme originated in 1999 and was developed by organizations including MITRE Corporation, Carnegie Mellon University, SANS Institute, and the CERT Coordination Center to reduce duplicated reporting across lists like the Bugtraq mailing list and vendor advisories from Netscape Communications and Microsoft. Over time, coordination expanded to involve stakeholders such as National Security Agency, US-CERT, European Commission, and private security firms like Kaspersky Lab and Symantec Corporation. The cataloging practice influenced standards from bodies like International Organization for Standardization and informed scoring cooperation with the Common Vulnerability Scoring System.

Each entry uses a standardized identifier format and metadata fields that reference affected products maintained by vendors such as Intel Corporation and ARM Holdings. The metadata often integrates with vulnerability scoring by FIRST (Forum of Incident Response and Security Teams) and feeds consumed by platforms including Red Hat Satellite, Microsoft System Center, and IBM QRadar. The identifiers interface with ticketing and patch management systems from ServiceNow and Atlassian for lifecycle tracking used by enterprise teams at Goldman Sachs, JPMorgan Chase, and Morgan Stanley.

Security researchers from institutions such as MIT, Stanford University, University of California, Berkeley, ETH Zurich, and companies like Checkpoint Software Technologies rely on the catalog to publish coordinated disclosures alongside organizations like Zero Day Initiative and Google Project Zero. Enterprises in sectors overseen by agencies such as the Food and Drug Administration and regulators like Financial Industry Regulatory Authority map identifiers to compliance frameworks including NIST Special Publication 800-53 and Payment Card Industry Data Security Standard. The identifiers facilitate cross-referencing in vulnerability databases like those maintained by Exploit Database and inform incident reports by Mandiant and advisories from CERT-EU.

Governance involves stewardship by MITRE Corporation with operational liaisons to groups such as FIRST and advisory input from companies including Amazon.com, Facebook, Oracle Corporation, and Siemens. Policy development draws perspectives from academic centers like RAND Corporation and think tanks such as Center for Strategic and International Studies. International coordination engages standards bodies like Internet Engineering Task Force and regional agencies such as ENISA to maintain interoperability with vulnerability intelligence used by vendors such as Siemens, Schneider Electric, and Rockwell Automation.

Critiques voiced by researchers at University of Cambridge, Princeton University, Columbia University, and independent analysts from The Brookings Institution note issues including granularity, timeliness, and regional biases that affect stakeholders such as Small Business Administration registrants and vendors like Fortinet. Observers from Electronic Frontier Foundation and policy groups such as Open Technology Institute have argued for clearer provenance, richer metadata, and expanded coordination with international registries used by governments like Japan and Australia. Academic studies published in venues associated with ACM and IEEE have examined how cataloguing practices interact with exploit markets and disclosure norms exemplified by initiatives like Coordinated Vulnerability Disclosure.

Category:Computer security