Navigating the CVE Database

Introduction

CVE is a set of standardized identifiers that help cybersecurity tools correlate vulnerabilities across multiple sources. The database also includes a brief description and public references for each entry.

A vulnerability is an error in software code that allows threat actors to gain direct access to a system or network. CVE can be used with the Common Vulnerability Scoring System (CVSS) to determine the severity of a vulnerability.

Search by Identifier

In the cybersecurity world, there is growing agreement that sharing vulnerabilities can significantly reduce attack vectors and their impact. One of the most important initiatives to enable this is the Common Vulnerabilities and Exposures (CVE) program, launched in 1999 by MITRE, a Federally Funded Research and Development Center.

The CVE approach provides a standard method for cataloging and identifying publicly known information security vulnerabilities. It is accomplished through the use of a unique identifier that can be used to correlate vulnerability data across multiple tools and databases.

The identifier is formed by the CVE prefix followed by a four-digit year portion representing the date the CVE record was created. A CVE record describes a specific software, firmware, or hardware vulnerability and often references additional information like vendor advisories, CVSS-based scores, and fix information. A group of organizations called CNAs curates CVE records, primarily product vendors participating in the CVE program through their internal vulnerability management processes and various external programs such as bug bounties.

Search by Taxonomy

CVE provides an identifier and description for each security vulnerability or exposure. Authorized Data Publishers (ADPs) enrich CVE records with additional information, including risk scores, lists of manufactured products, and other details about the vulnerability or exposure.

Named entity recognition, or sequence labeling, is one of the most important tasks within Natural Language Processing (NER). It is an essential part of automated vulnerability research and allows a system to identify which sequences belong to a certain CVE.

CVE records are not just a list of vulnerabilities but a set of standards for describing them. The system uses a security lexicon to ensure each identifier is correctly categorized. This lexicon contains common product- and vendor names that are used in a large number of CVE summaries. The lexicon was compiled from about 130 000 vulnerabilities describing 50 000 different products, excluding all CVEs not in the validation and test dataset.

Search by Impact

The CVE program brings standardization and information sharing to the vulnerability management processes of cybersecurity teams. By using common identifiers, organizations can compare the capabilities of different security tools.

A CVE record contains a standard identifier, a brief description, and references to complementary information about the vulnerability. The record also includes a description of how the identifier was assigned. The CVE record is based on a report by the relevant CNA (software vendor, open source project, coordination center, or bug bounty service).

The information in a CVE record is verified and enriched by the U.S. National Vulnerability Database (NVD). The NVD builds upon the information contained in a CVE record, including providing fix, severity, and impact ratings. The same CNAs feed the NVD and the CVE list, but the information in the NVD is more detailed than that in the CVE list. The NVD and the CVE board are open to all members of the cybersecurity community through an open and collaborative process. The board comprises various cybersecurity organizations, research institutions and experts, government departments and agencies, and end-users. The board provides critical input into the goals, operating structure, and strategic direction of the CVE program.

Search by Impact Graph

Vulnerabilities introduced by unpatched software are the primary focus of CVE. However, many types of vulnerabilities introduce risk to an organization and do not fit the definition of a CVE vulnerability. These risks must be identified, prioritized, and mitigated using various methods, including those unrelated to unpatched software.

While the CVE identifiers enable you to correlate information about a vulnerability rapidly, they do not contain all the details needed for a comprehensive vulnerability management program. For example, a CVE entry usually includes a brief description of the vulnerability and references that offer more detailed information.

Conclusion

Additional information can be retrieved from multiple sources compatible with CVE, including the NIST National Vulnerability Database (NVD) and vendor advisories. The NVD also performs analysis of published CVEs, producing CVSS scores and other useful information for vulnerability prioritization. Falcon Spotlight synchronizes with NVD and provides these additional details alongside the standard CVE information in each vulnerability result.