CVE: what it is

In short

A CVE is a code such as CVE-2021-44228: the prefix, the year in which the identifier was assigned and a sequence number of at least four digits. The code does not say how serious the vulnerability is: it only says which vulnerability it is, without ambiguity. Severity is expressed separately, usually with the CVSS score.

How it works

The CVE programme was launched in 1999 and is coordinated by MITRE with the support of the US Cybersecurity and Infrastructure Security Agency (CISA). Identifiers are not assigned by a single office: they are issued by a network of CNAs (CVE Numbering Authorities), that is, software vendors, research centres and national CERTs authorised to number vulnerabilities within their own scope.

Each CVE record contains a short description, the products and versions affected and references to the vendor's advisories. Other catalogues add information on top of the same code: NIST's National Vulnerability Database, for example, gives the CVSS score and the type of weakness (CWE). In Europe, ENISA runs the European Vulnerability Database, which collects vulnerabilities with cross-references to CVE codes.

Be careful not to confuse CVE and CWE: the first is a single vulnerability in a specific product, the second is the category of error (for example "SQL injection") from which that vulnerability arises.

Why it matters

The CVE is the thread that links a finding to its fix. When the vendor publishes an update that "fixes CVE-2023-34362", you can check in seconds whether it is exactly the problem that came out of your vulnerability assessment, and organise your patch management accordingly.

There is, however, a limit to be aware of: not everything has a CVE. A default password left on a device, a network folder open to everyone, a service exposed on the internet by mistake are serious problems that have no identifier. A report that counts only CVEs sees part of the picture.

Example

In December 2021 CVE-2021-44228, known as Log4Shell, was made public: a flaw in the Apache Log4j 2 Java library that allowed remote code execution, with a CVSS score of 10.0. Many companies did not know they were using Log4j, because it was embedded inside other products. Those with a software inventory showing vulnerabilities per machine could answer the question "are we exposed?" within a few hours. The others had to search server by server.

If you want to understand where the CVE fits into testing work, the guide vulnerability assessment and penetration testing compared explains the differences between the two approaches.

Related terms

• CVSS: the severity score associated with a CVE
• Zero-day: a vulnerability exploited before a fix exists
• Vulnerability assessment
• Patch management