Common Vulnerabilities and Exposures (CVE)

Common Vulnerabilities and Exposures (CVE)
Name	Common Vulnerabilities and Exposures
Abbreviation	CVE
Launch	1999
Maintained by	Mitre Corporation

Common Vulnerabilities and Exposures (CVE) Common Vulnerabilities and Exposures (CVE) is a publicly available cataloging system for information security flaws and exposures that provides unique identifiers intended to be used across National Institute of Standards and Technology initiatives, United States Department of Homeland Security, and by vendors such as Microsoft, Apple Inc., Google LLC, Red Hat, Oracle Corporation. The list supports coordination among organizations including MITRE Corporation, FIRST, European Union Agency for Cybersecurity, United States Computer Emergency Readiness Team, and vendors like Cisco Systems and IBM. CVE identifiers are widely referenced in advisories from Amazon (company), Mozilla Foundation, VMware, Inc., SAP SE and in standards promulgated by International Organization for Standardization, Internet Engineering Task Force, Payment Card Industry Security Standards Council.

Overview

CVE provides canonical identifiers used in advisories from Microsoft, Apple Inc., Google LLC, Red Hat, Oracle Corporation, Cisco Systems and analysis by research groups at Massachusetts Institute of Technology, Stanford University, Carnegie Mellon University, University of Cambridge. The registry interacts with cataloging projects such as National Vulnerability Database, Exploit Database, SecurityFocus, CERT Coordination Center, Zero Day Initiative, and Open Source Security Foundation to harmonize references used by vendors like Adobe Systems and Intel Corporation. Analysts from Kaspersky Lab, Symantec Corporation, McAfee, Trend Micro, Palo Alto Networks and responders at FireEye use CVE identifiers alongside taxonomies like Common Weakness Enumeration and Common Vulnerability Scoring System in incident reports distributed via platforms such as GitHub, GitLab and Bitbucket.

History and Governance

CVE was initiated in 1999 with coordination among entities including National Institute of Standards and Technology, MITRE Corporation, Department of Homeland Security (United States), and early contributors from CERT Coordination Center and companies like Microsoft and Cisco Systems. Governance evolved through partnerships with FIRST, European Union Agency for Cybersecurity, U.S. Cybersecurity and Infrastructure Security Agency, and non-profit stakeholders such as Open Source Initiative and Linux Foundation. Oversight and policy decisions involve advisory relationships with institutions like Harvard University, Yale University, Columbia University, and consortia such as Cloud Security Alliance and Internet Society.

Identification and Numbering System

Each CVE identifier follows a canonical format adopted to accommodate contributions from organizations including MITRE Corporation, National Vulnerability Database, FIRST, Microsoft and Google LLC. The numbering scheme interfaces with score systems from Common Vulnerability Scoring System and metadata used by vendors such as Red Hat, Debian Project, Canonical Ltd., SUSE, Oracle Corporation for package advisories. Security teams at Facebook (now Meta Platforms, Inc.), Twitter, Inc., LinkedIn Corporation and Dropbox, Inc. use these IDs in internal ticketing integrated with platforms like JIRA (software) and ServiceNow.

CVE Assignment and Publication Process

CVE identifiers are assigned by designated authorities including MITRE Corporation and multiple CVE Numbering Authorities such as Microsoft, Red Hat, Oracle Corporation, Debian Project, Canonical Ltd., SUSE, and by coordination with National Vulnerability Database. Publications appear in advisories from Cisco Systems, Adobe Systems, Apple Inc., Google LLC, IBM, Intel Corporation and are cited in vulnerability research from Kaspersky Lab, Trend Micro, Palo Alto Networks, FireEye, McAfee. The process involves disclosure practices seen in policies from Microsoft, Google LLC, Mozilla Foundation, Apple Inc. and timelines governed by incident response frameworks advocated by CERT Coordination Center and FIRST.

Relationship to Other Vulnerability Databases and Standards

CVE identifiers are cross-referenced by databases such as National Vulnerability Database, Exploit Database, SecurityFocus, VulnDB, OSS Index, Snyk, Nessus, OpenVAS, Metasploit Project, Qualys, Tenable, Inc. and standards including Common Vulnerability Scoring System and Common Weakness Enumeration. Integration occurs with package ecosystems managed by Debian Project, Ubuntu (operating system), Red Hat Enterprise Linux, SUSE Linux Enterprise, Homebrew (package manager), npm (software), PyPI, RubyGems, Maven (software) and vulnerability feeds used by Splunk, ELK Stack, Graylog for security monitoring.

Usage in Security Tools and Incident Response

Security orchestration tools from Splunk, IBM Security, Palo Alto Networks, CrowdStrike, FireEye, McAfee, Trend Micro, and scanners like Nessus, OpenVAS and Qualys reference CVE identifiers for triage by teams at Microsoft, Google LLC, Amazon (company), Facebook (now Meta Platforms, Inc.), Twitter, Inc., LinkedIn Corporation, Dropbox, Inc.. Incident responders from CERT Coordination Center, United States Computer Emergency Readiness Team, European Union Agency for Cybersecurity, Cisco Systems' Talos group, and research labs at MITRE Corporation use CVE-linked workflows alongside ticketing systems like JIRA (software), ServiceNow and collaboration platforms such as Slack (software), Microsoft Teams, Atlassian Confluence.

Criticisms and Limitations

Critiques of CVE practices have been voiced by researchers at Harvard University, Stanford University, Carnegie Mellon University, University of Oxford, and practitioners from Kaspersky Lab, Recorded Future, Mandiant, CrowdStrike, focusing on issues like assignment delays, coverage gaps affecting ecosystems managed by npm (software), PyPI, RubyGems, and coordination problems with vendors including Microsoft, Oracle Corporation, Google LLC, Apple Inc.. Additional concerns raised by consortia such as Open Source Initiative and Linux Foundation address resource constraints, disclosure policy tensions among CERT Coordination Center, FIRST, US Cyber Command and the operational needs of companies like Red Hat, Canonical Ltd., Debian Project.

Category:Computer security