WTF is a CVE?
Short version
A CVE is a public ID for one specific security flaw, so everyone knows they are talking about the same bug.
The briefing
- Stands for
- Common Vulnerabilities and Exposures.
- The dog tag
- Each flaw in the catalog gets one CVE Record, with an ID in the format CVE-YYYY-NNNN.
- The year
- When the ID was reserved or the flaw went public, not when it was found.
- The digits
- Arbitrary. A bigger number does not mean a worse bug.
- On the record
- At least the ID, a short description, the affected products and versions and some references.
- Who runs it
- The CVE Board sets the direction. MITRE currently runs the Secretariat that keeps the infrastructure going.
- Who assigns IDs
- CVE Numbering Authorities (CNAs): vendors, researchers, open source groups, CERTs and others, each authorized to cover its own patch of ground. GitHub is one.
- What it proves
- That the bug has a name. It does not prove the bug is dangerous or under attack.
- What it is not
- A severity score, which is not the CVE Program's job. It is also separate from the US National Vulnerability Database, which it feeds.
In the Threat Brief this looks like:
CVE-YYYY-NNNN: flaw in ExampleApp 3.x. Fixed in 3.2.1.
That ID is the search term that cuts through the noise. The bulletin, the vendor and your scanner all mean the same bug.
Example only. The product, versions and names are made up.
What to do
- Put the CVE ID into your vendor advisory, your scanner or your dependency tool.
- For how bad, check the CVSS score.
- For whether attackers are using it, check CISA KEV.