4

I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:C/I:C/A:P). A brief description or summary of the vulnerability would also be good.

So for instance, given CVE-2017-1000369, we would need to get the CVSS score and summary NIST provides for CVE-2017-1000369.

Are there good API's which take a CVE id as a parameter, and give back the CVSS base vector? I've tried this one but found it to be unreliable (it sometimes doesn't include the base vector, even though NIST has provided one, the latency is really high, and it sometimes craps out entirely).

2
  • Sorry for the late comment. Maybe this will be useful for others: cveapi.com. You can perform a GET request to v1.cveapi.com/<cve-number>.json and get the full NIST response back. It's free to use and doesn't require any auth. Hope it helps!
    – Dieter
    Jan 23 at 7:29
  • P.S.: I don't understand why this question was marked as off-topic. Asking about retrieving CVE data seems pretty on-point to me?
    – Dieter
    Jan 23 at 7:41
5

You can use the CVE API that Red Hat maintains. It has a lot of options to search for a vulnerability given a CVE or other parameters, you can even run a search by components with a range of dates (before and after filters).

An example of the query that you may be interested in, will be something like this:

https://access.redhat.com/labs/securitydataapi/cve/CVE-2017-1000369.json

The output will be something like this (using the CVE you provided in your question):

{
  "threat_severity": "Low",
  "public_date": "2017-06-19T00:00:00",
  "bugzilla": {
    "description": "\nCVE-2017-1000369 Exim: Privilege escalation via multiple memory leaks\n    ",
    "id": "1457748",
    "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1457748"
  },
  "cvss3": {
    "cvss3_base_score": "2.9",
    "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
    "status": "draft"
  },
  "details": [
    "\nExim supports the use of multiple \"-p\" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.\n    "
  ],
  "statement": "\nExim itself is not vulnerable to privilege escalation, but this particular flaw in exim can be used by the stackguard vulnerability (https://access.redhat.com/security/vulnerabilities/stackguard) to achieve privilege escalation.\n    ",
  "package_state": {
    "product_name": "Red Hat Enterprise Linux 5",
    "fix_state": "Will not fix",
    "package_name": "exim",
    "cpe": "cpe:/o:redhat:enterprise_linux:5"
  },
  "name": "CVE-2017-1000369"
}

The Complete Documentation for the API can be found here.

Warning: The data could be limited to components in Red Hat products, but from my experience using it, I did not have much problems with the information provided by the API. This API uses CVSS3 only, this could be a problem for you.

A second option (with CVSS2 support) could be the NVD/CVE as JSON files project hosted on Github, an example of a request with the same CVE that you posted will be:

https://olbat.github.io/nvdcve/CVE-2017-1000369.json

The output will be something like this:

{
  "cve": {
    "data_type": "CVE",
    "data_format": "MITRE",
    "data_version": "4.0",
    "CVE_data_meta": {
      "ID": "CVE-2017-1000369",
      "ASSIGNER": "cve@mitre.org"
    },
    "affects": {
      "vendor": {
        "vendor_data": [
          {
            "vendor_name": "exim",
            "product": {
              "product_data": [
                {
                  "product_name": "exim",
                  "version": {
                    "version_data": [
                      {
                        "version_value": "4.89",
                        "version_affected": "<="
                      }
                    ]
                  }
                }
              ]
            }
          }
        ]
      }
    },
    "problemtype": {
      "problemtype_data": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-264"
            }
          ]
        }
      ]
    },
    "references": {
      "reference_data": [
        {
          "url": "http://www.debian.org/security/2017/dsa-3888",
          "name": "DSA-3888",
          "refsource": "DEBIAN",
          "tags": [

          ]
        },
        {
          "url": "http://www.securityfocus.com/bid/99252",
          "name": "99252",
          "refsource": "BID",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ]
        },
        {
          "url": "http://www.securitytracker.com/id/1038779",
          "name": "1038779",
          "refsource": "SECTRACK",
          "tags": [

          ]
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2017-1000369",
          "name": "https://access.redhat.com/security/cve/CVE-2017-1000369",
          "refsource": "CONFIRM",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21",
          "name": "https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21",
          "refsource": "MISC",
          "tags": [
            "Mitigation",
            "Third Party Advisory"
          ]
        },
        {
          "url": "https://security.gentoo.org/glsa/201709-19",
          "name": "GLSA-201709-19",
          "refsource": "GENTOO",
          "tags": [

          ]
        },
        {
          "url": "https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt",
          "name": "https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt",
          "refsource": "MISC",
          "tags": [
            "Third Party Advisory"
          ]
        }
      ]
    },
    "description": {
      "description_data": [
        {
          "lang": "en",
          "value": "Exim supports the use of multiple \"-p\" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time."
        }
      ]
    }
  },
  "configurations": {
    "CVE_data_version": "4.0",
    "nodes": [
      {
        "operator": "OR",
        "cpe_match": [
          {
            "vulnerable": true,
            "cpe23Uri": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "4.89"
          }
        ]
      }
    ]
  },
  "impact": {
    "baseMetricV3": {
      "cvssV3": {
        "version": "3.0",
        "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "attackVector": "LOCAL",
        "attackComplexity": "LOW",
        "privilegesRequired": "NONE",
        "userInteraction": "NONE",
        "scope": "UNCHANGED",
        "confidentialityImpact": "NONE",
        "integrityImpact": "LOW",
        "availabilityImpact": "NONE",
        "baseScore": 4.0,
        "baseSeverity": "MEDIUM"
      },
      "exploitabilityScore": 2.5,
      "impactScore": 1.4
    },
    "baseMetricV2": {
      "cvssV2": {
        "version": "2.0",
        "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
        "accessVector": "LOCAL",
        "accessComplexity": "LOW",
        "authentication": "NONE",
        "confidentialityImpact": "NONE",
        "integrityImpact": "PARTIAL",
        "availabilityImpact": "NONE",
        "baseScore": 2.1
      },
      "severity": "LOW",
      "exploitabilityScore": 3.9,
      "impactScore": 2.9,
      "obtainAllPrivilege": false,
      "obtainUserPrivilege": false,
      "obtainOtherPrivilege": false,
      "userInteractionRequired": false
    }
  },
  "publishedDate": "2017-06-19T16:29Z",
  "lastModifiedDate": "2017-11-04T01:29Z"
}

As you can see, it provides a lot of information that could be useful for your project (including CVSS V2), both projects are still active and updated, hope it helps.

Not the answer you're looking for? Browse other questions tagged or ask your own question.