Common Vulnerabilities And Exposures (CVE).

What Is CVE?

CVE stands for Common Vulnerabilities and Exposures. NIST describes it as a list of entries, each containing a unique identification number, a description, and at least one public reference, for publicly known cybersecurity vulnerabilities. Another NIST definition calls it a dictionary of common names for publicly known information system vulnerabilities.

A vulnerability is a weakness in a system that an attacker could use. CVE does not fix anything. It gives each known flaw a shared name, so people can talk about the same flaw without confusion.

What Does a CVE ID Look Like?

A CVE ID has three parts: the prefix CVE, a year and a sequence number of four or more digits, for example CVE-2014-12345. A CVE entry is built around the three parts NIST names. The identification number is the unique label. The description says what the flaw is. The public reference points to a page with more detail.

NIST also says the CVE list feeds the National Vulnerability Database. NIST describes CVE as an SCAP specification that provides unique, common names for publicly known information system vulnerabilities.

How Does a CVE Record Get Made?

The CVE Program describes the path in its page on CVE Records. Details such as scores and fixes come from other databases.

Why Do Advisories and Scanners All Quote CVE IDs?

Without a shared name, two teams can describe the same flaw in different words, and a patch note or a scanner report can be hard to match with an alert. A common identifier can make it easier to search, compare and track a flaw across tools and reports.

How Do You Match CVE IDs to Your Own Software?

CVE is a naming system, so the work starts when you match the names to your own systems.

• Keep a list of the software and devices you run, so you can check a new CVE against it.
• Search for the CVE number in vendor notices and advisories, using the public reference in the entry as a starting point.
• Decide what to fix first. A CVE entry names a flaw but does not rank it, so teams often add other information, such as a severity score.

Is a CVE the Same as a Vulnerability?

Not exactly. The vulnerability is the weakness in the software. The CVE is the entry that names and describes it. NIST describes the list as covering publicly known vulnerabilities.

Is a CVE the Same as a CVSS Score?

No. The CVE gives the flaw its name, description and reference. A CVSS score is a separate rating of severity. NIST defines CVE as a list of identified vulnerabilities, and the entry itself is not a score. Related terms are CVSS and vulnerability management.

Related Pages in the Knowledge Hub

• Vulnerability intelligence
• Log4Shell
• Known Exploited Vulnerabilities catalog
• Exploit Prediction Scoring System
• Common Weakness Enumeration
• Days from CVE publication to KEV listing

Sources

• NIST: NIST defines CVE as a list of entries for publicly known cybersecurity vulnerabilities. Each entry has an identification number, a description and a public reference.
• CVE Program: the page on CVE Records says a CNA assigns the ID and adds the description and references, then the Secretariat posts the record.
• CVE Program FAQ: CVE is not a vulnerability database, and the NVD provides fix and scoring information.
• CISA: CISA, which sponsors the CVE Program, describes it as the global standard for vulnerability identification, supported by a worldwide network of CVE Numbering Authorities.