-3

Can any vulnerability be assigned a CVE number?

For vulnerabilities like this:
http://seclists.org/fulldisclosure/2016/Apr/92

Can it be assigned a CVE number? (seems it does not have a CVE id now)

What about a vulnerabilities in websites (like Google.com) rather than a library?

  • 3
    What exactly are you asking? You can request a number for any vulnerability - see the process here: cve.mitre.org/cve/request_id.html – Rory Alsop May 9 '16 at 10:32
  • @RoryAlsop I have modified my question to include a website..since any kinds of software, websites, can have vulnerabilities, some very famous, some are infamous at all, maybe only few number of people using it, can all of them assigned CVE Id? – william007 May 9 '16 at 10:40
  • With a quick search, I found: en.wikipedia.org/wiki/… – schroeder May 9 '16 at 14:48
  • 2
    While Rory is correct, you can request a CVE-ID for any vulnerabily, not every vulnerability is eligible for a CVE-ID. Many requests are ignored or denied. – Xander May 9 '16 at 15:14
  • 1
    Even though CVEs have been issued for Wordpress plugins and themes it is a low number. Typically only given to widely used plugins and themes. If every single plugin/theme exploit was given an CVE it would require it's own directory. – Bacon Brad May 9 '16 at 17:38
2

CVEs are for vulnerabilities in software that is shipped and then consumed, not for vulnerabilities in services (e.g. websites). So if a vulnerability in the service (e.g. a website) is in something that is widely available as a software package (e.g. a flaw that is at its root in Apache, or PHP or WordPress for example) then the flaw within that software package would get a CVE.

If the flaw is in a service that is a custom written piece of software that is not available for download (e.g. Amazon, eBay, etc.) then that vulnerability would not get a CVE.

Ultimately the goal of CVE is to provide an identifier for a vulnerability so that when multiple organizations (e.g. the reporter and the upstream and the community using it) need to discuss the vulnerability they can all be sure they're actually talking about the same thing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.