Welcome to the messy of InfoSec community! :)
Unfortunately, when dealing with NVD data feeds only is common to get frustrated with either issue like that or any of the entry CVE update delay such as CPE and Status process (i.e., Analysing; Confirm; Rejected; and, Reserved).
That's why companies and nonprofits organizations, create their vulnerability identifications. The IBM X-Force (without acronym prefix) and SecurityFocus as BID (Bugtraq ID) are the greatest examples respectively.
What is the supposed correct way to find corresponding product and
vendor information for such cve's [sic]?
Answer: Add the CPE manually. You can contribute with NVD CPE Dictionary as well mailing to the NVD CPE team (the e-mail is in 2nd paragraph).
If you need more details about the vulnerability information:
According to the MITRE vulnerability report3, every CVE entries firstly raise from the MITRE's platform(s) when you request a CVE ID from a CVE Number Authorities (CNA) member, commonly MITRE CVEForm unless you contact with others CNA affiliate.
Usually, before a CVE-ID get CONFIRMED status, the Window Vulnerability must be completed. That is a concealed process which summarized in:
Vulnerability Found;
Vulnerability Reported;
90-days to whether the vendor answer back;
If the vendor doesn't answer the one who discovered the vulnerability in 90-days, the discoverer can do whatever he wants, including publishing the security issue information along with the exploit. Ordinarily, this sort of report happens on the SecList, PacketStorm or any other of the social platform such as Twitter and Blog post;
After vendor responding within 90 days, there is no predictable date for a vulnerability coming to the public from a foreign perspective because the communication is between the one that discovered the vulnerability and the vendor;
Assuming that the vendor answered, the final step is the release of the patch and the vulnerability detail.
MITRE Corporation is an American organization affiliated to Federally Funded Research and Development Centers (also known as FFRDC). The CVE-ID is a system provided by FFRDC that is operated by MITRE Corporation, and as you can see, their deeds are commonly chosen to standardize across the entire spectrum of security tools and services (Information Security Communities).
The NIST National Vulnerability Database (NVD) is a United States America government repository database to provide vulnerability management data for Security Content and Automation Protocol (SCAP) supplying. One of their products is the CPE dictionary, and their "CPE Dictionary Search" is the same as what he's providing in the XML file.
Have you noticed that each vulnerability information regardless of MITRE Corporation tends to a piece of miscorrelation?
Notwithstanding a CVE-ID can take a while to CONFIRM a reported vulnerability if a vendor does not confirm first. The other sticky situation, if you monitor MITRE CVE publishing entries and recognize when a CNA member release a CVE, you can note that the utmost occurrence of until a vulnerability becomes publicly.)
So, as I aforementioned: This miscorrelation tends to happen every time. That's is the principle of why working with only public information always dealt with a false positive and false negative.
