2

I noticed that there are a list of Platforms/Vendors for which a CVE can be applied for.

What happens if I find a CVE for a proprietary platform (that is commercially available), is there a way to get a CVE assigned for it?

2

Different vendors require different steps to be taken in order to get a CVE ID assigned for vulnerabilities.

If you check the MITRE CVE ID Request page here then you can follow the instructions to request an ID after locating the correct CVE Numbering Authority.

If the vendor is not specifically mentioned in any of the tables and a relevant CNA is not listed then you have to contact MITRE directly to request a CVE ID by filling out the form here.

1

I think the main thing here is to make sure you follow Responsible Disclosure:

From wikipedia:

Responsible disclosure is a computer security term describing a vulnerability disclosure model. It is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details.

If you just go and publish details of the vulnerability without giving the vendor enough time to put out a patch, you will actually be doing more damage than good because you will be enabling attackers to hack otherwise secure systems.

If this is your first time disclosing a vuln and it all seems a bit overwhelming then, as Ross Smith says, the MITRE organization than runs the CVE database can act as the mediator between you and the vendor.

1
  • @Mike_Ounsworth very much appreciate the heads up on that
    – pzirkind
    Mar 29 '17 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.