Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University.
Using it I can get sensitive information for all students and gain access to their accounts on the infrastructure. I'm planning to coordinate a vulnerability disclosure.
I am wondering whether I can get CVE numbers for it.
The short answer is no.
If it's a closed source product, and it is not off-the-shelf, or distributed, then there is no benefit to having a CVE number assigned.
In fact, the CVE assigning authorities would not consider such a request.
Please ensure vendor or product exists in the Products and Sources list cve.mitre.org/cve/data_sources_product_coverage.html
A CVE number is a way of alerting the public to an issue in applications they might use. It is not a posterity number.
You should contact the responsible persons for maintaining the system and disclose it as soon as possible to them, so that the risk that a malicious actor might find what you have found is minimized.
