Common Vulnerabilities And Exposures (CVE).

What is CVE?

CVE stands for Common Vulnerabilities and Exposures. NIST describes it as a list of entries, each containing a unique identification number, a description, and at least one public reference, for publicly known cybersecurity vulnerabilities. Another NIST definition calls it a dictionary of common names for publicly known information system vulnerabilities.

A vulnerability is a weakness in a system that an attacker could use. CVE does not fix anything. It gives each known flaw a shared name, so people can talk about the same flaw without confusion.

How does CVE work?

A CVE entry is built around the three parts NIST names. The identification number is the unique label. The description says what the flaw is. The public reference points to a page with more detail.

NIST also says the CVE list feeds the National Vulnerability Database. NIST describes CVE as an SCAP specification that provides unique, common names for publicly known information system vulnerabilities.

Why does it matter?

Without a shared name, two teams can describe the same flaw in different words, and a patch note or a scanner report can be hard to match with an alert. A common identifier can make it easier to search, compare and track a flaw across tools and reports. This is reasoning from the definition, not a claim from a source.

How can you use CVE to reduce risk?

CVE is a naming system, so the work starts when you match the names to your own systems. These steps are general.

• Keep a list of the software and devices you run, so you can check a new CVE against it.
• Search for the CVE number in vendor notices and advisories, using the public reference in the entry as a starting point.
• Decide what to fix first. A CVE entry names a flaw but does not rank it, so teams often add other information, such as a severity score.

These are general good habits and not a full program.

Is a CVE the same as a vulnerability?

Not exactly. The vulnerability is the weakness in the software. The CVE is the entry that names and describes it. NIST describes the list as covering publicly known vulnerabilities.

Is a CVE the same as a CVSS score?

No. The CVE gives the flaw its name, description and reference. A CVSS score is a separate rating of severity. NIST defines CVE as a list of identified vulnerabilities, and the entry itself is not a score. Related terms are CVSS and vulnerability management.

Related pages in the Knowledge Hub

• Vulnerability intelligence
• Log4Shell

Sources

• NIST: NIST defines CVE as a list of entries, each with a unique identification number, a description and at least one public reference, for publicly known cybersecurity….
• CISA: CISA, which sponsors the CVE Program, describes it as the global standard for vulnerability identification, supported by a worldwide network of CVE Numbering Authorities.