The purpose of this blog is to establish a dialogue and get your input on issues and topics important to CVE. Right-click and copy a URL to share a post.

Please use our LinkedIn page, or the CVE Request Web Form by selecting “Other” from the dropdown, to comment on the posts below.

Become a CNA to Assign Your Own CVE IDs

Comment on LinkedIn | Share this post

CVE Numbering Authorities, or “CNAs,” are organizations authorized to assign and populate CVE Entries to vulnerabilities affecting products within their distinct, agreed-upon scope.

A CNA may be a software vendor, open source project, coordination center, bug bounty service provider, or research group. CNAs are essential to the CVE Program’s success and every CVE Entry added to the CVE List is added by a CNA.

Benefits of Being a CNA

Currently, 101 organizations from around the world are actively participating in the CVE Program as CNAs. There is no monetary fee and no contract to sign to become a CNA. CNAs volunteer their own time for their own benefit.

The only requirements are to have a public vulnerability disclosure policy and a public source for new vulnerability disclosures, to agree to the CVE Terms of Use, and agree to follow the program’s rules and guidelines.

Becoming a CNA allows you to:

• Demonstrate mature vulnerability management practices and a commitment to cybersecurity to current and potential customers.
• Communicate value-added vulnerability information to your customer base.
• Control the CVE publication release process for vulnerabilities in your scope.
• Assign CVE IDs without having to share embargoed information with another CNA.
• Streamline your vulnerability disclosure processes.

CNAs are also able to participate in other aspects of the CVE Program. Examples include influencing the CNA rules and guidelines upon which the program operates, and joining one or more of the CVE Working Groups to help improve CVE workflows and processes.

How to Become a CNA

If your organization would like to become a CNA, please follow these four easy steps:

1. Contact the CNA Coordination Team.
2. Fill out the registration form.
3. Attend an introductory session.
4. Successfully create CVE ID entries from examples.

Comments or Questions?

If you have any questions, or would like to start the process, please use our CVE Request Web Form and select “Request information on the CVE Numbering Authority (CNA) Program” from the dropdown.

We look forward to hearing from you!

-	The CVE Team
	August 29, 2019
	CVE Request Web Form (select “Other” from dropdown)

CVE Working Groups Overview

Comment on LinkedIn | Share this post

The CVE Program has a number of Working Groups (WGs) actively focused on improving processes, workflows, and other aspects of the program as CVE continues to grow and expand. You may request to join a WG, or request more information, by using the CVE Request Web Form and selecting “Other” from the dropdown.

Current documents, repositories, and projects for CVE’s WGs are included below. Updates to this information will be posted on the CVE Working Groups page.

Automation Working Group (AWG)

Focused on identifying and advancing proposals for the collaborative design, development, and deployment of automated capabilities that support the efficient management of the CVE Program.

Documents:

• CVE ID Allocation Service Specification
• AWG Charter

Repository:

• AWG GitHub Repository

Projects:

• CVE ID Allocation Service
• CVE List GitHub Automation Pilot
• CVE JSON Schema Project
• CNA Registry Project

Strategic Planning Working Group (SPWG)

Focused on the long-term strategy (1-5 years) and goals of the CVE Program; will work closely with the CVE Board to determine goals and objectives and will act to achieve them.

Repository:

• SPWG GitHub Repository

CNA Coordination Working Group (CNACWG)

Focused on providing a forum for more effective communication and participation by the CVE Numbering Authorities (CNAs).

Documents:

• CNACWG Charter

CVE Entry Quality Working Group (QWG)

Focused on identifying areas where CVE content, rules, guidelines, and best practices must improve to better support stakeholder use cases.

CVE Workflow Working Group (CWWG)

Focused on providing a programmatic method for requesting and retrieving CVE IDs by enabling “just in time” CVE ID allocation.

CVE Outreach and Communications Working Group (OCWG)

Focused on promoting the CVE Program to achieve program adoption and coverage goals through increased community awareness.

To discuss this post with us, please use our LinkedIn page or the CVE Request Web Form by selecting “Other” from the dropdown.

We look forward to hearing from you!

-	The CVE Team
	May 30, 2019 (updated August 15, 2019)
	CVE Request Web Form (select “Other” from dropdown)

Refresher: When to Use the CVE Request Web Form

Comment on LinkedIn | Share this post

First introduced in August 2016, the online “CVE Request Web Form” is the main method for communicating with the CVE Program Root CNA. By using the web form, the CVE Program’s ability to receive, manage, track, and respond to user questions and CVE ID requests has significantly improved.

In this article, inspired by user questions, we will discuss when and how to use the CVE Request Web Form to best assist you.

Only Use the CVE Request Web Form to Contact the Program Root CNA

Each CVE Numbering Authority (CNA) has its own specific scope of coverage, and its own preferred way to be contacted. If you need to contact a CNA other than the Program Root CNA to request a CVE ID, or to ask a question, please use that specific CNA’s contact details as stated on the Request CVE IDs page.

The CVE Request Web Form is only used to contact the Program Root CNA.

When to Use the CVE Request Web Form

Use the web form to contact the Program Root CNA to do the following:

• Request a CVE ID
  
  Select this option to request a CVE ID(s) from the Program Root CNA only. The form includes a required information section for the type of vulnerability, product vendor name, and affected product name and version. There is also an optional information section to fill out that may assist us in processing your request.
  
  If you are unsure about a web form requirement, or need further clarification before starting the process, please continue to use the web form but select “Other” from the dropdown menu to ask us your question(s).
  
  
• Request a block of IDs (for CNAs only)
  
  Only current CNAs may use this selection to request blocks of CVE IDs.
  
  
• Notify CVE about a publication
  
  Select this option to notify the CVE Team that an advisory has been published. Required information includes providing a URL to the public advisory about the vulnerability, listing the CVE ID(s) that are included in the advisory, and any additional information and CVE ID Description updates.
  
  
• Request an update to an existing CVE Entry
  
  Select this option to provide updates for published CVE Entries. Required information includes the type of update (duplicate, rejection, split/merge, update description, update references, or other), the CVE ID of the CVE Entry to be updated, and a description of what change is needed. Optional information includes providing links to references that validate the need for an update.
  
  
• Request information on the CVE Numbering Authority (CNA) Program
  
  After reviewing the CVE Overview for Prospective CNAs and How to Become a CNA, select this option to find out more or to start the process of becoming a CNA.
  
  
• Other
  
  Select to ask questions about CVE IDs, CVE Entries, the ID request process, the web form, or to request information on topics not covered above.
  
  

If you need additional information regarding how use the web form, the form itself includes online help during each step of the process. Simply click the round, blue information button containing the letter "i". Please also see our Web Form FAQs.

What Happens Once a Request Is Submitted

Once you have submitted your request, you will receive an email message confirming receipt of your request and a reference number. Please add [email protected] and [email protected] as safe senders in your email client before completing the web form.

Any additional communications related to this request will be done through email using the same subject line as the confirmation email.

Did We Point You in the Right Direction?

To discuss this post with us, please use our LinkedIn page or the CVE Request Web Form by selecting “Other” from the dropdown.

We look forward to hearing from you!

-	The CVE Team
	January 3, 2019
	CVE Request Web Form (select “Other” from dropdown)

2018 Posts

A Look at the CVE and CVSS Relationship

Comment on LinkedIn | Share this post

We’ve received a few questions recently about CVSS and vulnerability severity scoring, so as a reminder, CVSS is a separate program from CVE.

CVE is a list of entries—each containing an identification number, a description, and at least one public reference—for publicly known cybersecurity vulnerabilities. CVE does not provide severity scoring or prioritization ratings for software vulnerabilities.

CVSS Defined

While separate from CVE, the Common Vulnerability Scoring System (CVSS) standard operated by the Forum of Incident Response and Security Teams (FIRST) can be used to score the severity of software vulnerabilities identified by CVE Entries.

CVSS Version 3.0 provides “a way to capture the principal characteristics of a vulnerability, and produce a numerical score reflecting its severity, as well as a textual representation of that score. The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes.”

CVE Entries are cited in the CVSS specification and documentation to identify individual vulnerabilities used as examples, but they are not required for using CVSS.

NVD Hosts a CVSS Calculator for CVE Entries

Severity rating scoring and prioritization for CVE Entries is available through a CVSS calculator provided by the U.S. National Vulnerability Database (NVD).

According to the NVD website, which is operated by the National Institute of Standards and Technology (NIST), NVD’s CVSS calculator for CVE Entries supports both the CVSS 2.0 and CVSS 3.0 standards, and provides qualitative severity rankings for CVE Entries using each version. In addition, NVD’s CVSS calculator also allows users to add two additional types of score data into their severity scoring: (1) temporal, for “metrics that change over time due to events external to the vulnerability,” and (2) environmental, for “scores customized to reflect the impact of the vulnerability on your organization.”

For details and help, visit NVD’s CVSS Calculator for CVE Entries on the NVD website.

CVE, CVSS, and NVD

To recap, CVE does not provide severity scoring or prioritization and does not have a direct relationship with CVSS. The sole purpose of the CVE List is to provide common identifiers—CVE Entries—for publicly known cybersecurity vulnerabilities.

CVE Entries can be scored for severity and prioritization using FIRST’s CVSS standard.

NIST’s NVD provides a free CVSS calculator for CVE Entries. NVD also provides a download on the NVD website of “CVSS scores for all published CVE vulnerabilities.” Visit the NVD website to learn more.

Did We Point You in the Right Direction?

To discuss this post with us, please use our LinkedIn page or the CVE Request Web Form by selecting “Other” from the dropdown.

We look forward to hearing from you!

-	The CVE Team
	September 11, 2018
	CVE Request Web Form (select “Other” from dropdown)

Come Meet with CVE at Black Hat 2018/DEF CON 26 on August 9

Comment on LinkedIn | Share this post

CVE Numbering Authority Program Lead Jonathan Evans will be at Black Hat USA 2018/DEF CON 26 in Las Vegas, Nevada, USA.

CVE Meet-Up, August 9

Please join us for an informal get together to talk CVE at the Black Hat USA 2018 and DEF CON 26 conferences. If you're interested, please meet us at 12:00 p.m. PT outside the House of Blues in the Mandalay Bay Casino.

We will determine the final location once we have everyone together. Questions or concerns: CVE Request Web Form and select “Other” from the dropdown.

Please stop by and say hello. We look forward to seeing you!

-	The CVE Team
	August 3, 2018
	CVE Request Web Form (select “Other” from dropdown)

CNA Processes Documentation Now on GitHub

Comment on LinkedIn | Share this post

We have updated the collection of processes documentation for CVE Numbering Authorities (CNAs) on our CVEProject Documentation website on GitHub. Please note that while many of the documents are hosted on our GitHub website, some are hosted here on the main CVE website.

The purpose of the collection is to provide guidance and assistance to CNAs so that they can correctly fulfill their responsibilities for properly writing and completing the information required for each CVE Entry they submit to the Program Root CNA to be added to the CVE List, as defined by the CNA Rules, Version 2.0.

CNA Processes Documentation & Onboarding Slides

This collection of documents includes the following:

• CNA Resources
• Contacting the Program Root CNA
• Basic Information
• Requesting Blocks of CVE IDs/Submitting CVE Entry Information
• CNA Documentation and Onboarding
• CNA Metrics Requirements

• CNA Processes Documentation
Current CNAs:
• CNA Rules v2.0
• CNA Onboarding Processes
• CVE Content Decisions
• Submitting CVE Entries to Root CNAs
Prospective CNAs:
• CVE overview for prospective CNAs
• Instructions for how to become a CNA


• CNA Onboarding Slides
• Becoming a CNA
• CNA Processes
• Counting Rules Guidance
• Creating a CVE Entry for Submission
• Submitting CVE Entries to Program Root CNA

If you have any questions or comments about the collection of CNA Processes Documentation & Onboarding Slides, please contact us via our CVE Request web form by selecting “Other” from the dropdown menu.

We look forward to hearing from you!

-	The CVE Team
	April 6, 2018
	CVE Request Web Form (select “Other” from dropdown)

CNA Rules, Version 2.0 Now in Effect

Comment on LinkedIn | Share this post

Version 2.0 of the CVE Numbering Authorities (CNA) Rules took effect on January 1, 2018. The CNA Rules are the policies and processes for managing the CVE Numbering Authorities (CNAs) Program, and were revised with significant input from the CNA community.

CNA Rules, Version 2.0, which was updated from Version 1.1, includes detailed information on the following:

• CNAs Overview – Federated CNA Structure, and Purpose and Goal of the CNA Rules
• Rules for All CNAs – Assignment, Communication, and Administration
• Responsibilities of Root and Primary CNAs – Specific Assignment, Communications, and Administration Rules for Root CNAs and for the Primary CNA
• CNA Candidate Process – Qualifications, and On-Boarding Process
• Appeals Process
• Definitions
• CVE Information Format
• Common Vulnerabilities and Exposures (CVE) Counting Rules – Purpose, Introduction, Definitions, Vulnerability Report, Inclusion Decisions, and Counting Decisions
• Terms of Use
• Process to Correct Counting Issues
• Acronyms
• Quarterly Metrics
• Disclosure and Embargo Policies

For details about the changes from v1.1 to v2.0, please see our “CNA Rules, Version 2.0 to Take Effect on January 1st” blog article, issue tracker, and change logs.

If you have any questions or comments about the new CNA Rules document, please contact us via our CVE Request web form by selecting “Other” from the dropdown menu.

We look forward to hearing from you!

-	The CVE Team
	January 1, 2018
	CVE Request Web Form (select “Other” from dropdown)

2017 Posts

CNA Rules, Version 2.0 to Take Effect on January 1st

Comment on LinkedIn | Share this post

The policies and processes managing the CVE Numbering Authorities (CNAs) Program, known as the “CNA Rules,” have been revised with significant input from the CNA community. These revised rules, CVE Numbering Authorities (CNA) Rules, Version 2.0, will go into effect on January 1, 2018.

CNA Rules, Version 2.0, which is updated from Version 1.1, includes the following clarifications and improvements:

• Fixed a number of typos and reworded some phrasing for clarity.
• Clarified existing rules regarding communicating with other vendors or CNAs and the difference between CVE entries that are marked as disputed versus rejected.
• Defined additional terms, such as what it means for a vulnerability to be “public” and the definition of “hardware” within CVE and what hardware can receive CVE IDs.
• Set the CVE JSON format to be the preferred format for submitting CVE requests.
• Removed the CVE assignment requirement for Root CNAs, making it optional.
• A new rule indicating that CNAs must publish their CNA scope on their website as well as some other disclosure process information.

For detailed information about the changes, please see the issue tracker and change logs.

If you have any questions or comments about the revised CNA Rules document, please contact us via our CVE Request web form by selecting “Other” from the dropdown menu.

We look forward to hearing from you!

-	The CVE Team
	October 13, 2017
	CVE Request Web Form (select “Other” from dropdown)

Become a CNA

Comment on LinkedIn | Share this post

CVE Numbering Authorities, or “CNAs,” are how the CVE List is built. Every CVE Entry added to the list is assigned by a CNA.

The majority of CNAs are currently software vendors that assign CVE Entries to issues in their own products, but many vulnerability researchers and third-party coordinators also participate by assigning CVE IDs to issues in third-party products per their specified scopes of coverage. In all cases, by issuing CVE IDs themselves without directly involving MITRE in the details of the specific vulnerabilities, CNAs are able to ensure CVE IDs are available for inclusion in the first-time public announcement of a new vulnerability, which greatly benefits the overall cyber security community as organizations share information about the vulnerabilities and remediate them.

Actively Expanding the Number of CNAs

As of today, August 2, 2017, there are 69 total CNAs participating in the CVE program: 57 software vendors, 7 third-party coordinators, 4 vulnerability researchers, and MITRE as the Primary CNA.

And the CVE program has been actively growing the list of participating CNAs, which now includes organizations from around the world with 14 countries represented as illustrated in this map:

You too can become a CNA

Please consider joining us as a CNA. Participation is voluntary, and the benefits of participation include the ability to publicly disclose a vulnerability with an already assigned CVE ID, the ability to control the disclosure of vulnerability information without pre-publishing, and notification of vulnerabilities in products within a CNA's scope by researchers who request a CVE ID from them.

If your organization would like to become a CNA, please follow these three steps:

1. Review the “CVE Numbering Authorities (CNA) Rules” document in its entirety.
2. Closely review the How to Become a CNA section of this website, which is excerpted from the “CNA Rules” above.
3. Contact us via our CVE Request web form by selecting “Other” from the dropdown menu.

We look forward to hearing from you!

-	The CVE Team
	August 2, 2017
	CVE Request Web Form (select “Other” from dropdown)

Come Meet with CVE at Black Hat 2017 on July 27 and DEF CON 25 on July 28

Comment on LinkedIn | Share this post

CVE Numbering Authority Program Lead Dan Adinolfi, and CVE Team Member Anthony Singleton, will be at Black Hat USA 2017 and DEF CON 25 next week in Las Vegas, Nevada, USA.

We invite you to join us to talk CVE at either or both events:

CVE Meet-Up, July 27

Please join us for an informal get together to talk CVE at Black Hat USA 2017. If you're interested, please meet us at 12:00 p.m. PT outside the House of Blues in the Mandalay Bay Casino.

We will determine the final location once we have everyone together. Questions or concerns: CVE Request Web Form - select “Other” from the dropdown.

CVE Talk, July 28

Dan and Anthony will present a talk entitled "CVE IDs and How to Get Them" at 1:10 p.m. PT in the Neopolitan Ballroom and Milano VIII at Caesars Palace at the "Wall of Sheep" at DEF CON 25.

Talk synopsis from the conference website:

"The Common Vulnerabilities and Exposures (CVE) program uniquely identifies and names publicly-disclosed vulnerabilities in software and other codebases. Whether you are a vulnerability researcher, a vendor, or a project maintainer, it has never been easier to have CVE IDs assigned to vulnerabilities you are disclosing or coordinating around. This presentation will be an opportunity to find out how to participate as well as a chance to offer your thoughts, questions, or feedback about CVE. Attendees will learn what is considered a vulnerability for CVE, how to assign CVE IDs to vulnerabilities, how to describe those vulnerabilities within CVE ID entries, how to submit those assignments, and where to get more information about CVE assignment."

Please stop by either or both events and say hello. We look forward to seeing you!

-	The CVE Team
	July 20, 2017
	CVE Request Web Form (select “Other” from dropdown)

Why is a CVE entry marked as "RESERVED" when a CVE ID is being publicly used?

Comment on LinkedIn | Share this post

A CVE Identifier (CVE ID) is marked as "RESERVED" when it has been reserved for use by a CVE Numbering Authority (CNA) or security researcher, but the details of it are not yet included in the CVE entry. Often, this is because the original requester of the CVE ID assignment has not sent an update to MITRE with the information needed to populate the CVE entry.

If you are aware of a CVE ID that is being used publicly but is not yet included in the CVE List, you can request that the CVE ID be updated through the CVE Request web form. MITRE will coordinate with the original requester to have the missing public information added to the entry.

CVE IDs are made public on countless forums, mailing lists, and other publications. CVE ID entries cannot be published without public references and other descriptive information. Searching the Internet for any public reference to a reserved CVE ID is a non-trivial problem to solve, and MITRE must rely on the community to assist with updating CVE information as it becomes public. MITRE is looking for new ways to automate and expand discovery processes, but the scale and breadth of the searchable space is growing exponentially. We hope that stakeholders will assist with this process by notifying MITRE when they see a discrepancy, and MITRE will work to quickly and accurately update outdated entries that are reported to them.

Do you have a suggestion for how MITRE could more effectively find public references scattered around the (ever-growing) Internet? You can share your ideas through the CVE Request web form by selecting “Other” from the dropdown.

-	The CVE Team
	May 10, 2017
	CVE Request Web Form (select “Other” from dropdown)

Now you can easily comment on CVE Blog posts using our new "CVE-CWE-CAPEC" page on LinkedIn

Comment on LinkedIn | Share this post

We have created a CVE-CWE-CAPEC page on LinkedIn as an easy way for you to comment on and share CVE Blog posts.

Current and past CVE Blog content will be available there. Feel free to leave comments on any of the older posts. Please use this new page to comment on, ask questions about, and share our newest posts as we move forward.

We will also be posting news items on the LinkedIn page that may be of interest to you. Feel free to comment on, ask questions about, and share these posts as well.

As you probably noted from the title of our new LinkedIn page above, it's not solely about CVE. We also hope to encourage discussion about issues and topics related to Common Weakness Enumeration (CWE™) and Common Attack Pattern Enumeration and Classification (CAPEC™). As with CVE, both CWE and CAPEC are community-driven standardization projects addressing common needs among IT and cybersecurity professionals, and we encourage you to visit their websites to check them out.

Finally, if you have any suggestions about what you want to see as future posts on the new LinkedIn page, please let us know by commenting on any of the posts already available there, or by contacting us directly on the CVE Request Web Form by selecting “Other” from the dropdown, or by email at [email protected] or [email protected].

Our new "CVE-CWE-CAPEC" page is available on LinkedIn at https://www.linkedin.com/company/11033649. Please stop by and say hello. We look forward to hearing from you.

-	The CVE Team
	March 9, 2017
	CVE Request Web Form (select “Other” from dropdown)

Summary of your feedback about updating info in CVE ID Descriptions

Comment on LinkedIn | Share this post

Thank you for your responses to our most recent post "What's your opinion on updating CVE ID Descriptions?" about whether or not CVE ID Descriptions should be updated as new information becomes available, or if we should we reject and recreate the CVE IDs instead.

Updating of CVE ID Descriptions is preferred

The majority of respondents indicated that updating CVE ID Descriptions with new information is preferable to rejecting and issuing new CVE IDs.

The goals of CVE entries are to help people find the information they need about a vulnerability and provide enough information to allow people to be confident they are talking about the same vulnerability. Ensuring that CVE entries contain the most recent information on a vulnerability, either by updating an existing CVE entry or rejecting and issuing a new CVE entry, supports these goals.

Moving forward

As the CVE program continues to develop its policies and practices, we will consider the feedback from the CVE community on the benefits of updating CVE entries versus issuing new CVE entries.

If you have any further comments on the practice of updating CVE descriptions, please let us know. You can offer your feedback through the CVE Request Web Form by selecting “Other” from the dropdown.

Thank you again to all who participated.

-	The CVE Team
	February 2, 2017
	CVE Request Web Form (select “Other” from dropdown)

2016 Posts

What's your opinion on updating CVE ID Descriptions?

Comment on LinkedIn | Share this post

Last month, we asked the CVE community how you used CVE ID Descriptions. This month, we are following up on that question, asking about another aspect of how CVE ID Descriptions and their content are used.

Specifically, we would like to hear your thoughts on updating CVE ID Descriptions when new details about the vulnerability become available.

When a CVE ID is published, the Description of the vulnerability includes the details that are available about the vulnerability at that time. But as time goes by, more information may come to light regarding the vulnerability that should be reflected in the Description.

For example, the products or versions of products that are affected by the vulnerability may need to be updated after a vendor releases new information. Also, the CVE ID could change from covering a single product to a library or protocol that affects many products.

To update or not update

When such changes happen, CVE could update existing CVE ID Descriptions with that new information. But is doing so a problem for CVE consumers?

For example, in December, someone may see a new CVE ID describing a vulnerability in version 1.2 of ProductX. They use version 1.3, so they can ignore the vulnerability. But then the following February, ProductX's vendor finds that the vulnerability does affect version 1.3, and CVE updates the CVE ID Description to include that detail. At this point, the consumer may not notice the change, or they find themselves suddenly susceptible to a vulnerability to which they thought they weren't vulnerable.

Alternately, CVE could assign a new CVE ID that includes both version 1.2 and 1.3 and reject the original CVE ID. The scope and affected products of the new CVE ID would be unambiguous, and the new CVE ID would be picked up by the usual vulnerability management processes that an organization might follow. The downside of this methodology is confusion about the state of the original CVE ID, which is still valid but not complete.

One scenario that CVE has seen commonly is as follows: A vendor wants to issue an advisory before they know what the fixed patch version will be. They could include the currently known, affected versions, but this could mistakenly mean that later versions are not affected. Alternatively, they could leave out mentioning any version information in the first place and update the description when they know what is the complete range is.

What do you think?

Should CVE update CVE ID Descriptions as new information becomes available, or should we reject and recreate CVE IDs instead? Is there another practice that you would find more helpful?

Please contact us through the CVE Request Web Form by selecting “Other” from the dropdown with your thoughts regarding updating CVE ID Descriptions before the end of this month.

All feedback will be collected, aggregated, and posted on this page the first week or so of January. Also, please let us know in your message if you do not want your feedback included in the publicly posted results.

We look forward to hearing from you!

-	The CVE Team
	December 15, 2016
	CVE Request Web Form (select “Other” from dropdown)

Summary of your feedback about how Descriptions are used in CVE IDs

Comment on LinkedIn | Share this post

Thank you for your responses to our CVE blog question "What's your opinion on how Descriptions are used in CVE IDs?". We received five responses from various CVE users, and we look forward to hearing more from across the CVE community.

A business need for Description in CVE IDs

Overall, there appears to be a business need for CVE ID Descriptions. The details provided in the Descriptions strengthen an organization's business case by providing the details required to add credibility to the vulnerability claim and to differentiate between vulnerabilities. CVE ID Descriptions are not dependent on a reference website, improving availability. The Descriptions are searchable, users can track changes, and they can be used in different formats and presentations.

CVE ID Descriptions are often used internally to facilitate the discussion about a vulnerability. A concise CVE ID Description is easier to read on different devices then a linked reference. In addition, linked references are not always available, relevant information is not always evident, and websites do not display properly on different types of devices.

All the information provided in the CVE ID Description is seen as valuable, with the affected product/impacted version being the most important. The priorities of other fields can vary, however the more extensive or expensive the fix, the more all Description fields are important.

Moving forward

In October 2016, other entities were given the ability to write CVE ID Descriptions. Feedback on the quality of CVE ID Descriptions will be very useful for understanding the effects of that change.

If you find the content of CVE ID Descriptions does not match your needs, please let us know through the CVE Request Web Form by selecting “Other” from the dropdown.

Thank you again to all who participated.

-	The CVE Team
	December 2, 2016
	CVE Request Web Form (select “Other” from dropdown)

What's your opinion on how Descriptions are used in CVE IDs?

Comment on LinkedIn | Share this post

Since its inception in 1999, the CVE Program has included IDs, references, and descriptions in CVEs. Descriptions have primarily functioned as a method for the CVE Program to search CVEs, identify duplicates, and perform other similar functions.

We believe that other members of the community use Descriptions as well, but are unsure how they are used today or which parts of Descriptions are considered valuable.

The CVE Team invites you to contact us via our CVE Request Web Form (select “Other” from the dropdown) between now and November 17, 2016 to tell us about your experience using Descriptions. All feedback will be collected, aggregated, and posted on this page the week of November 28, 2016. Please let us know in your message if you do not want your feedback included in the publicly posted results.

Any and all feedback about Descriptions in CVE IDs is welcome, but in your response we ask that you please answer these three specific questions:

1. Do you use or have a business need for Descriptions in CVE IDs as they exist today? If yes, can you explain the use or need? If not, would a CVE ID still be useful to you without the Description (i.e., an ID and one or more references)?
2. Descriptions include information such as affected products and versions, affected components, attack types, attack vectors, and impact. Do you find all of this information equally valuable? If yes, what information is of most value and can you prioritize it? Is there any information that you would suggest CVE add or include when available (i.e., are Descriptions in CVE IDs missing anything)? Is there information included in a CVE Description that is not valuable to you? Why?
3. What industry or community do you associate yourself with (e.g., government, vulnerability discloser, security product vendor, security product user, security industry, other)? This will help us identify how valuable descriptions are to CVE Program stakeholders.

We look forward to hearing from you!

- The CVE Team
November 3, 2016
CVE Request Web Form
(select “Other” from dropdown)