NVD - CVE FAQs (2024)

FAQs

How would you answer the argument that threat actors could use CVE? ›

I would say that threat actors can use CVE as a way of information about vulnerabilities. But I'd say it is also important to note that CVE's main purpose would be to strengthen cybersecurity. Scroll down to CVE List Basics . What is the process by which a vulnerability becomes a CVE listing?

CVE – Common Vulnerabilities and Exposures (CVE) is a list of publicly disclosed vulnerabilities and exposures that is maintained by MITRE. NVD – The National Vulnerability Database (NVD) is a database, maintained by NIST, that is fully synchronized with the MITRE CVE list.

The NVD catalogs vulnerabilities based on the Common Vulnerabilities and Exposures (CVE) naming standard. Each CVE entry contains important metadata like descriptions, severity scores, and references to related advisories or solutions.

The intention of the CVE Program is to be comprehensive with respect to all publicly known vulnerabilities. While CVE prioritizes the assignment of CVE Records for the vendors, products, and product categories listed on the List of Partners page, a CVE ID may be requested for any vulnerability.

A CVE entry describes a known vulnerability or exposure. Each CVE entry contains a standard identifier number with status indicator (i.e. "CVE-1999-0067", "CVE-2014-12345", "CVE-2016-7654321"), a brief description and references related vulnerability reports and advisories. Each CVE ID is formatted as CVE-YYYY-NNNNN.

Incomplete information: A Published CVE Record may lack sufficient information for the vulnerability to be re-created by a CVE Program stakeholder. In this case, the technology vendor, maintainer, or third party may dispute the CVE Record.

The National Vulnerability Database is so overwhelmed with a steadily increasing number of software and hardware flaws that the National Institute of Standards and Technology, which maintains the common vulnerabilities and exposures repository, called for a slight pause to regroup and reprioritize its efforts.

The NVD provides critical information such as Common Vulnerability Scoring System (CVSS) scores, applicability assertions, and Common Platform Enumeration (CPE) data. By leveraging the NVD, organisations can prioritise and address vulnerabilities effectively, strengthening their IT infrastructure's security.

The "year" feeds are updated once per day, while the "recent" and "modified" feeds are updated every two hours. The NVD plans to retire all legacy data feeds while guiding any remaining data feed users to updated application-programming interfaces (APIs).

Why would the NVD be useful to you if you were a security officer at a large firm in the US? ›

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance.

The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance.

Very little information—by design, the CVE is intended to serve as a vulnerability database. It provides only an ID, a brief description, and references for more information. It does not include all information required to run a complete vulnerability management program.

The CVE Assignment and Vetting Process

CVE IDs are assigned by the CVE Assignment Team and CNAs. The diversity of CNAs provides varied yet specific areas of expertise for different types of vulnerabilities. Each CNA is able to reserve a CVE ID when the need arises.

CVE IDs are assigned to flaws that meet a specific set of criteria. They must be fixed independently of any other bugs, they must be acknowledged by the vendor as having a negative impact on security, and they must be affecting only one codebase. Flaws that impact more than one product get separate CVEs.

Common Vulnerabilities and Exposures (CVEs) are security threats that are included in a list or reference system of known risks. The CVE threat list is maintained by the MITRE Corporation, a nonprofit organization that runs U.S. federal government-sponsored research and development centers.

The CVE (Common Vulnerabilities and Exposures) process is a standardized method for identifying and naming cybersecurity vulnerabilities. It provides a unique identifier for each vulnerability, along with a detailed description of the issue and information on how to mitigate the risk.

Common capabilities a threat actor can use include:

Malware development and deployment (viruses, ransomware, trojans), or ransomware-as-a-service. Exploitation of software vulnerabilities. Phishing attacks and social engineering in order to gain access to passwords.