What happens once a vulnerability has been added to a database? That is, what can we (security/IT professionals) do about it? How do we find out what to do?

  • I am not sure I understand what you mean? What is your goal? To fix the vulnerability? Are you interested in a specific case? – Anders Oct 19 '16 at 21:38
  • That is most often the wrong question. The right question would be: what has already been done, when the vulnerability was added to a CVE database?. Often the steps to take are already documented at that point. – grochmal Oct 19 '16 at 21:47

Giving it a CVE number (and adding it to a database) is just giving it a common name that can be used to refer to it. By itself, it does nothing.

But by that point, the people who have requested a CVE number be assigned to the vulnerability, have studied it and have prepared recommendations: a patch, a configuration workaround, a recommendation to shut off some software/hardware pending a fix.

What you do as a professional is up to you. You can decide to do nothing, or to apply the patch to all nodes, or to apply the patch in lab and see if it breaks something, or to switch vendors.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.