Common Vulnerabilities and Exposures

Short description: Catalog of information security problems

Logo

The Common Vulnerabilities and Exposures (CVE) system, originally Common Vulnerability Enumeration,[1] provides a reference method for publicly known information-security vulnerabilities and exposures.[2] The United States' Homeland Security Systems Engineering and Development Institute FFRDC, operated by The MITRE Corporation, maintains the system, with funding from the US National Cyber Security Division of the US Department of Homeland Security.[3] The system was officially launched for the public in September 1999.[4]

The Security Content Automation Protocol uses CVE, and CVE IDs are listed on MITRE's system as well as the basis for the US National Vulnerability Database.[5]

## Contents

* 1 CVE identifiers
* 2 CVE data fields
* 2.1 Description
* 2.2 Record Creation Date
* 2.3 Obsolete fields
* 3 Changes to syntax
* 4 CVE SPLIT and MERGE
* 5 Search CVE identifiers
* 6 CVE usage
* 7 CVE assignment issues
* 8 2025 funding issues
* 9 See also
* 10 References
* 11 External links

## CVE identifiers

MITRE Corporation's documentation defines CVE Identifiers (also called "CVE names", "CVE numbers", "CVE-IDs", and "CVEs") as unique, common identifiers for publicly known information-security vulnerabilities in publicly released software packages. Historically, CVE identifiers originally had a status of "candidate" ("CAN-") and could then be promoted to entries ("CVE-"), but this practice was ended in 2005[6][7] and all identifiers are now assigned as CVEs. The assignment of a CVE number is not a guarantee that it will become an official CVE entry (e.g., a CVE may be improperly assigned to an issue which is not a security vulnerability, or which duplicates an existing entry). If found not to meet criteria, MITRE or a CVE Numbering Authority (CNA) can summarily place the entry into REJECTED status.

CVEs are assigned by a CVE Numbering Authority (CNA).[8] While some vendors acted as a CNA before, the name and designation was not created until 1 February 2005.[9] There are four primary types of CVE number assignments:

1. The MITRE Corporation functions as Editor and Primary CNA
2. Various CNAs assign CVE numbers for their own products (e.g., Microsoft, Oracle, HP, Red Hat)
3. A third-party coordinator such as CERT Coordination Center may assign CVE numbers for products not covered by other CNAs
4. Researchers, in one case, have been granted the CNA role.[10]

When investigating a vulnerability or potential vulnerability it helps to acquire a CVE number early on. CVE numbers may not appear in the MITRE or NVD databases for some time (days, weeks, months or potentially years) due to issues that are embargoed (the CVE number has been assigned but the issue has not been made public), or historically in cases where the entry is not researched and written up by MITRE due to resource issues. The benefit of early CVE candidacy is that all future correspondence and coordination can refer to the CVE number to ensure all parties are referring to the same vulnerability. Information on getting CVE identifiers for issues with open source projects is available from Red Hat[11] and GitHub.[12]

CVEs are for software that has been publicly released; this can include betas and other pre-release versions if they are widely used. Commercial software is included in the "publicly released" category, but custom-built software that is not distributed would historically not be given a CVE. For the first two decades of the program, services (e.g., a Web-based email provider) are not assigned CVEs for vulnerabilities found in the service (e.g., an XSS vulnerability) unless the issue exists in an underlying software product that is publicly distributed. Official rules have not been published regarding this change but some CNAs including MITRE have begun assigning CVEs to service-based vulnerabilities as far back as 2000.[13]

## CVE data fields

The CVE database contains several fields:

### Description

This is a standardized text description of the issue(s). One common entry is:

> ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

This means that the entry number has been reserved by Mitre for an issue or a CNA has reserved the number. So when a CNA requests a block of CVE numbers in advance (e.g., Red Hat currently requests CVEs in blocks of 500), the CVE number will be marked as reserved even though the CVE itself may not be assigned by the CNA for some time. Until the CVE is assigned, Mitre is made aware of it (i.e., the embargo passes and the issue is made public), and Mitre has researched the issue and written a description of it, entries will show up as "** RESERVED **".

### Record Creation Date

This is the date the entry was created. For CVEs assigned directly by Mitre, this is the date Mitre created the CVE entry. For CVEs assigned by CNAs (e.g., Microsoft, Oracle, HP, Red Hat) this is also the date that was created by Mitre, not by the CNA. When a CNA requests a block of CVE numbers in advance (e.g., Red Hat currently requests CVEs in blocks of 500) the entry date that CVE is assigned to the CNA.

### Obsolete fields

The following fields were previously used in CVE records, but are no longer used.

* Phase: The phase the CVE is in (e.g., CAN, CVE).
* Votes: Previously board members would vote yea or nay on whether or not the CAN should be accepted and turned into a CVE.
* Comments: Comments on the issue.
* Proposed: When the issue was first proposed.

## Changes to syntax

In order to support CVE IDs beyond CVE-YEAR-9999 (an issue known as the 'CVE10k problem'[14]) a change was made to the CVE syntax in 2014 and took effect on 13 January 2015.[15]

The new CVE-ID syntax is variable length and includes:

CVE prefix + Year + Arbitrary Digits

The variable-length arbitrary digits begin at four fixed digits and expand with arbitrary digits only when needed in a calendar year; for example, CVE-YYYY-NNNN and if needed CVE-YYYY-NNNNN, CVE-YYYY-NNNNNN, and so on. The schema is compatible with previously assigned CVE-IDs, which all include a minimum of four digits.

## CVE SPLIT and MERGE

CVE attempts to assign one CVE per security issue; however, in many cases this would lead to an extremely large number of CVEs (e.g., where several dozen cross-site scripting vulnerabilities are found in a PHP application due to lack of use of `htmlspecialchars()` or the insecure creation of files in `/tmp`).[16]

To deal with this, guidelines (subject to change) cover the splitting and merging of issues into distinct CVE numbers. As a general guideline, one should first consider issues to be merged, then issues should be split by the type of vulnerability (e.g., buffer overflow vs. stack overflow), then by the software version affected (e.g., if one issue affects version 1.3.4 through 2.5.4 and the other affects 1.3.4 through 2.5.8 they would be SPLIT) and then by the reporter of the issue (e.g., if Alice reports one issue and Bob reports another issue, the issues would be SPLIT into separate CVE numbers).[16]

Another example is Alice reports a /tmp file creation vulnerability in version 1.2.3 and earlier of ExampleSoft web browser; in addition to this issue, several other `/tmp` file creation issues are found. In some cases this may be considered as two reporters (and thus SPLIT into two separate CVEs, or if Alice works for ExampleSoft and an ExampleSoft internal team finds the rest it may be MERGE'ed into a single CVE). Conversely, issues can be merged, such as if Bob finds 145 XSS vulnerabilities in ExamplePlugin for ExampleFrameWork regardless of the versions affected and so on, they may be merged into a single CVE.[16]

## Search CVE identifiers

The Mitre CVE database can be searched at the CVE List Search, and the NVD CVE database can be searched at Search CVE and CCE Vulnerability Database.

## CVE usage

CVE identifiers are intended for use with respect to identifying vulnerabilities:

> Common Vulnerabilities and Exposures (CVE) is a dictionary of common names (i.e., CVE Identifiers) for publicly known information security vulnerabilities. CVE's common identifiers make it easier to share data across separate network security databases and tools, and provide a baseline for evaluating the coverage of an organization's security tools. If a report from one of your security tools incorporates CVE Identifiers, you may then quickly and accurately access fix information in one or more separate CVE-compatible databases to remediate the problem.[17]

Users who have been assigned a CVE identifier for a vulnerability are encouraged to ensure that they place the identifier in any related security reports, web pages, emails, and so on.

## CVE assignment issues

Per section 7 of the CNA Rules, a vendor which received a report about a security vulnerability has full discretion in regards to it.[18] This can lead to a conflict of interest as a vendor may attempt to leave flaws unpatched by denying a CVE assignment at first place – a decision which Mitre can't reverse. The "!CVE" (not CVE) project, announced in 2023, aims to collect vulnerabilities that are denied by vendors, so long as they are considered valid by a panel of experts from the project.[19]

CVE identifiers have been awarded for bogus issues and issues without security consequences.[20] In response, a number of open-source projects have themselves applied to become the CVE Numbering Authority (CNA) of their own project.[21]

## 2025 funding issues

On 15 April 2025, it was reported that the contract between MITRE and the US government, set to expire the day after,[22] would be allowed to expire. Reports stated that the expiration of the contract would bring an end to the operational arm of the CVE program, including assigning new CVEs, while the database would remain accessible via GitHub.[23]

Just prior to its expiration, the contract was extended for 11 months, averting the shutdown of the program.[24] The contract is now set to expire on 16 March 2026.

## See also

* Common Vulnerability Scoring System (CVSS)
* Common Weakness Enumeration (CWE)
* Computer security
* European Union Vulnerability Database
* Software composition analysis
* Static application security testing

## References

1. ↑ "CVE - Towards a Common Enumeration of Vulnerabilities". 2025-04-18. https://cve.mitre.org/docs/docs-2000/cerias.html.
2. ↑ Wu, Xiaoxue; Zheng, Wei; Chen, Xiang; Wang, Fang; Mu, Dejun (2020). "CVE-assisted large-scale security bug report dataset construction method" (in en). Journal of Systems and Software 160. doi:10.1016/j.jss.2019.110456. https://linkinghub.elsevier.com/retrieve/pii/S0164121219302304. Retrieved 24 October 2022.
3. ↑ "CVE – Common Vulnerabilities and Exposures". Mitre Corporation. 3 July 2007. https://cve.mitre.org/. "CVE is sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security."
4. ↑ "CVE - History". cve.mitre.org. https://cve.mitre.org/about/history.html.
5. ↑ "CVE - Common Vulnerabilities and Exposures (CVE)". https://cve.mitre.org/.
6. ↑ "CVE - Frequently Asked Questions". https://cve.mitre.org/about/faqs.html#cve_list_retire_term_cve.
7. ↑ Kouns, Jake (13 August 2009). "Reviewing(4) CVE". https://vulndb.wordpress.com/2009/08/16/reviewing4-cve/.
8. ↑ "CVE - CVE Numbering Authorities". MITRE Corporation. 1 February 2015. https://www.cve.org/PartnerInformation/ListofPartners.
9. ↑ "CVE - CVE Blog "Our CVE Story: Ancient History of the CVE Program – Did the Microsoft Security Response Center have Precognition?" (guest author)". https://cve.mitre.org/blog/September222020_Our_CVE_Story_Ancient_History_of_the_CVE_Program_-_Did_the_Microsoft_Security_Response_Center_have_Precognition.html.
10. ↑ "CVE - CVE Blog "My CVE Story: How I Became the CVE Program's First Vulnerability Researcher CNA" (guest author)". 2021-03-15. https://cve.mitre.org/blog/March152021_My_CVE_Story_How_I_Became_the_CVE_Programs_First_Vulnerability_Researcher_CNA.html.
11. ↑ "CVE OpenSource Request HOWTO". Red Hat Inc.. 14 November 2016. https://github.com/RedHatProductSecurity/CVE-HOWTO. "There are several ways to make a request depending on what your requirements are:"
12. ↑ "About GitHub Security Advisories". GitHub. https://docs.github.com/en/code-security/security-advisories/about-github-security-advisories#cve-identification-numbers. "GitHub Security Advisories builds upon the foundation of the Common Vulnerabilities and Exposures (CVE) list"
13. ↑ "CVE - CVE-2000-0081". 2021-12-04. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0081.
14. ↑ Christey, Steven M. (12 January 2007). "CVE - The CVE-10K Problem". The MITRE Corporation. https://cve.mitre.org/data/board/archives/2007-01/msg00000.html.
15. ↑ "CVE - CVE ID Syntax Change". 13 September 2016. https://cve.mitre.org/cve/identifiers/syntaxchange.html.
16. ↑ 16.0 16.1 16.2 "CVE Abstraction Content Decisions: Rationale and Application (Archived)". The Mitre Corporation. 15 June 2005. https://cve.mitre.org/cve/editorial_policies/cd_abstraction.html.
17. ↑ "CVE - About CVE". https://cve.mitre.org/about/.
18. ↑ "CVE Numbering Authority Rules - Assignment Rules". The MITRE Corporation. 1 February 2020. pp. 13–15. https://www.cve.org/Resources/Roles/Cnas/CNA_Rules_v3.0.pdf.
19. ↑ Edge, Jake (5 December 2023). "Supplementing CVEs with !CVEs". https://lwn.net/Articles/953738/.
20. ↑ Edge, Jake (13 September 2023). "The bogus CVE problem". https://lwn.net/Articles/944209/.
21. ↑ "A turning point for CVE numbers". 14 February 2024. https://lwn.net/Articles/961978/.
22. ↑ "CONTRACT to THE MITRE CORPORATION" (in en). https://www.usaspending.gov/award/CONT_AWD_70RCSJ24FR0000018_7001_70RSAT20D00000001_7001.
23. ↑ Bradley, Tony. "Cybersecurity World On Edge As CVE Program Prepares To Go Dark" (in en). https://www.forbes.com/sites/tonybradley/2025/04/15/cybersecurity-world-on-edge-as-cve-program-prepares-to-go-dark/?ctpv=searchpage.
24. ↑ Brunfield, Cynthia (16 April 2025). "CVE program averts swift end after CISA executes 11-month contract extension" (in en). CSO Online (IDG Communications). https://www.csoonline.com/article/3963190/cve-program-faces-swift-end-after-dhs-fails-to-renew-contract-leaving-security-flaw-tracking-in-limbo.html.

## External links

* No URL found. Please specify a URL here or add one to Wikidata.
* National Vulnerability Database (NVD)
* Common Configuration Enumeration (CCE) at NVD
* vFeed the Correlated and Aggregated Vulnerability Database - SQLite Database and Python API
* Cyberwatch Vulnerabilities Database , third party
* What Enterprises need to know about IT Security Audit Services?

* v
* t
* e

MITRE Computer Security Ontologies

* Common Weakness Enumeration
* Common Vulnerabilities and Exposures
* Common Vulnerability Scoring System
* Common Attack Pattern Enumeration and Classification

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Common Vulnerabilities and Exposures. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Common_Vulnerabilities_and_Exposures&oldid=3982214"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template