Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Why does neither MITRE nor NVD list out the name(s) of the reporter(s) of a CVE? e.g. for CVE-2018-1123, neither MITRE, nor NVD gives credit to reporters. However, for some CVEs, SecurityFocus does list out the names of the reporters.
If an external researcher needs to prove to an independent third party that he/she reported the bug, how will he/she go about that?
The CVE database does allow "Discoverer(s)/Credits" to be recorded, as shown on the MITRE CVE form:
However, the help for that field states:
Please indicate the individual(s) or organization(s) that found the vulnerability or reported the vulnerability to you. This information will not be included in the public CVE entry.
Back in 2000, Steve Christey had this comment on the CVE editorial board mailing list:
With respect to Marcus' comments, it is clear that some vulnerability discoverers want proper credit for discovering something, and it is becoming a more common practice (consider Microsoft's acknowledgement policy and recent SGI advisories).
Which implies that back when CVE started up there was an assumption that discoverers didn't want credit. Today, that seems strange; reporting vulnerabilities - responsibly - is a respectable job which you can even get paid for. But 25 years ago, that was far from the case. People could rightly fear legal reprisals, and reputational damage, if they were responsible for publishing a vulnerability. For how would they ever have found it if they were not evil hackers?
The CVE process has been one of several agents of change, making it possible to "own" discovery of a vulnerability more easily today.
The common method of attribution is via the announcement; and in many cases, the References field of the CVE (which is public) will point to the original advisory announcement. (I seem to recall 8lgm had noteworthy 'tude on their releases back in the 90s). The recent trend of fancy ALLCAPS vuln names with trendy websites is just more of the same.
(This leaves unanswered how to convince a 3rd party (well, 4th - Discoverer/Reporter, MITRE/CNA, Vendor - those three talk. You're asking about someone separate from those three, and I don't know the answer to that.)
