I have two questions regarding going through the process to requesting and getting a CVE ID for a vulnerability.
Should I contact the Vendor first and wait to see if they acknowledge the vulnerability and release a patch and then submit for a CVE ID or should I just submit for a CVE ID now?
On the CVE submission form
It says the following:
IMPORTANT: Once a CVE ID is assigned to your vulnerability, it will not be published in the CVE List until you have submitted a URL pointing to public information about the vulnerability. Without a public reference, the CVE ID will display as "RESERVED" in the CVE List.
My question is about the "a URL pointing to public information". Does this public information have to come from the Vendor or can this public information be something like a URL point to an exploit db page?