I have two questions regarding going through the process to requesting and getting a CVE ID for a vulnerability.

  1. Should I contact the Vendor first and wait to see if they acknowledge the vulnerability and release a patch and then submit for a CVE ID or should I just submit for a CVE ID now?

  2. On the CVE submission form

It says the following:

IMPORTANT: Once a CVE ID is assigned to your vulnerability, it will not be published in the CVE List until you have submitted a URL pointing to public information about the vulnerability. Without a public reference, the CVE ID will display as "RESERVED" in the CVE List.

My question is about the "a URL pointing to public information". Does this public information have to come from the Vendor or can this public information be something like a URL point to an exploit db page?

  • 1
    There may not even be a (single) specific vendor affected, cf. the recently famous KRACKattacks, so they are not necessarily the intended reference. In fact, the usual process is to kindly inform vendors about a vulnerabilty and to "threaten" publishing it after a certain time. It is this, ultimately your, publication that becomes a (primary) reference. See also the list cve.mitre.org/data/refs/index.html of common publication sources (including MISC for the case that you create your own specific url, again as for example recently www.krackattacks.com) – Hagen von Eitzen Oct 26 '17 at 20:47
up vote 5 down vote accepted

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author), I apply for a CVE before notifying the vendor.

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it. It would leave you uncertain if you are affected by one or two vulnerabilities.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immediate risk.

  1. Contacting the vendor would generally be useful, especially to have it confirmed and maybe assessed from a vendors point of view.

    However, if you want to make sure you are credited for finding the vulnerability and not the vendor, you should submit and then do a responsible disclosure to the vendor.

  2. This can be any url, it does not need to be from the vendor; it doesn’t even need to be a responsible disclosure, you could link to the description of a github repo with an exploit, for example.

    Usually, though, it’s the vendors bulletin after a patch is released or a blog post from the finder.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.