CVE submission process?

Question

I have two questions regarding going through the process to requesting and getting a CVE ID for a vulnerability.

1. Should I contact the Vendor first and wait to see if they acknowledge the vulnerability and release a patch and then submit for a CVE ID or should I just submit for a CVE ID now?

2. On the CVE submission form

It says the following:

IMPORTANT: Once a CVE ID is assigned to your vulnerability, it will not be published in the CVE List until you have submitted a URL pointing to public information about the vulnerability. Without a public reference, the CVE ID will display as "RESERVED" in the CVE List.

My question is about the "a URL pointing to public information". Does this public information have to come from the Vendor or can this public information be something like a URL point to an exploit db page?

Answer 1

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author), I apply for a CVE before notifying the vendor.

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it. It would leave you uncertain if you are affected by one or two vulnerabilities.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immediate risk.

Answer 2

1. Contacting the vendor would generally be useful, especially to have it confirmed and maybe assessed from a vendors point of view.

   However, if you want to make sure you are credited for finding the vulnerability and not the vendor, you should submit and then do a responsible disclosure to the vendor.

2. This can be any url, it does not need to be from the vendor; it doesn’t even need to be a responsible disclosure, you could link to the description of a github repo with an exploit, for example.

   Usually, though, it’s the vendors bulletin after a patch is released or a blog post from the finder.

Answer 3

Should I contact the Vendor first and wait to see if they acknowledge the vulnerability and release a patch and then submit for a CVE ID or should I just submit for a CVE ID now?

Yes, you should absolutely contact the Vendor first, especially if it's a serious vulnerability. Getting assigned a CVE ID takes an upwards of 5 days nowadays and as a responsible security researcher, you should always prioritize contacting the Vendor.

What I usually do is:

1. Contact Vendor about vulnerability
2. Wait for non-automated reply
3. Request CVE ID from Mitre (if Vendor is not a CNA)
4. Share the CVE ID with the Vendor
5. Work with Vendor towards public disclosure after patch is deployed

If the Vendor is unresponsive to your initial email, then you should make another question as there's a lot of ways to deal with that.