I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University.

Using it I can get sensitive information for all students and gain access to their accounts on the infrastructure. I'm planning to coordinate a vulnerability disclosure.

I am wondering whether I can get CVE numbers for it.

  • Have you looked up the CVE number assigning process?
    – schroeder
    Commented Mar 16, 2020 at 7:37
  • 1
    What was not clear? Any answer will simply point you to the CVE page. If you've read it, then you need to explain why the page didn't help you.
    – schroeder
    Commented Mar 16, 2020 at 7:44
  • 4
  • 1
    I don't think so... Who cares about a software that is only deployed on your university? Nobody but your university staff. So there's absolutely no interest to have a CVE for such a product.... Just contact your university staff and forget about glory in this case ;-)
    – binarym
    Commented Mar 16, 2020 at 11:10
  • 2
    I didn't found a strict reference on CVE site, but if you have a look to wikipedia page, you can read: "MITRE Corporation's documentation defines CVE Identifiers (also called "CVE names", "CVE numbers", "CVE-IDs", and "CVEs") as unique, common identifiers for publicly known information-security vulnerabilities in publicly released software packages."
    – binarym
    Commented Mar 16, 2020 at 11:15

1 Answer 1


The short answer is no.

If it's a closed source product, and it is not off-the-shelf, or distributed, then there is no benefit to having a CVE number assigned.

In fact, the CVE assigning authorities would not consider such a request.

Please ensure vendor or product exists in the Products and Sources list cve.mitre.org/cve/data_sources_product_coverage.html

A CVE number is a way of alerting the public to an issue in applications they might use. It is not a posterity number.

You should contact the responsible persons for maintaining the system and disclose it as soon as possible to them, so that the risk that a malicious actor might find what you have found is minimized.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .