CVE – Frequently Asked Questions

1. What is a CVE?
A CVE (Common Vulnerabilities and Exposures) is a publicly disclosed cybersecurity vulnerability or exposure in software or firmware.

2. Who assigns CVEs?
CVE IDs are assigned by CVE Numbering Authorities (CNAs), including organizations like MITRE, software vendors, and security researchers.

3. What is the format of a CVE ID?
CVE-YYYY-NNNNN
Example: CVE-2024-12345

• YYYY: Year of disclosure

• NNNNN: Unique identifier number
  
  

4. Where can I find details about a CVE?

• https://cve.mitre.org/

• https://nvd.nist.gov/ – for severity scores, metrics, and patch info
  
  

5. What is CVSS?
CVSS (Common Vulnerability Scoring System) rates the severity of a CVE on a scale from 0 to 10.

• 9.0–10.0: Critical

• 7.0–8.9: High

• 4.0–6.9: Medium

• 0.1–3.9: Low
  
  

6. How is a CVE different from a bug?
A CVE is a security-related flaw that could be exploited by an attacker, whereas a bug may just be a functionality issue without security implications.

7. How should I respond to a new CVE?

• Assess: Check if your environment is affected

• Prioritize: Use CVSS and business context

• Patch/Mitigate: Apply vendor patches or workarounds

• Monitor: Watch for exploits in the wild
  
  

8. What’s the role of vendors in CVEs?
Vendors disclose, fix, and publish CVEs for their products, often through coordinated disclosure with researchers or CERTs.

9. Can CVEs be disputed or rejected?
Yes. If a reported issue doesn't meet the criteria or is inaccurate, it can be marked as REJECTED or DISPUTED in the CVE database.

10. Why are CVEs important for compliance?
Many security standards (like ISO 27001, PCI-DSS, SOC 2) require vulnerability management. CVE tracking is a critical part of that process.