-4

I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University.

Using it I can get sensitive information for all students and gain access to their accounts on the infrastructure. I'm planning to coordinate a vulnerability disclosure.

I am wondering whether I can get CVE numbers for it.

Improve this question
10
  • Have you looked up the CVE number assigning process?
    – schroeder ♦
    Commented Mar 16, 2020 at 7:37
  • 1
    What was not clear? Any answer will simply point you to the CVE page. If you've read it, then you need to explain why the page didn't help you.
    – schroeder ♦
    Commented Mar 16, 2020 at 7:44
  • 4
    Does this answer your question? How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?, How to exactly create a CVE?, CVE submission process?, ...
    – Steffen Ullrich
    Commented Mar 16, 2020 at 8:15
  • 1
    I don't think so... Who cares about a software that is only deployed on your university? Nobody but your university staff. So there's absolutely no interest to have a CVE for such a product.... Just contact your university staff and forget about glory in this case ;-)
    – binarym
    Commented Mar 16, 2020 at 11:10
  • 2
    I didn't found a strict reference on CVE site, but if you have a look to wikipedia page, you can read: "MITRE Corporation's documentation defines CVE Identifiers (also called "CVE names", "CVE numbers", "CVE-IDs", and "CVEs") as unique, common identifiers for publicly known information-security vulnerabilities in publicly released software packages."
    – binarym
    Commented Mar 16, 2020 at 11:15

1 Answer 1

Reset to default
5

The short answer is no.

If it's a closed source product, and it is not off-the-shelf, or distributed, then there is no benefit to having a CVE number assigned.

In fact, the CVE assigning authorities would not consider such a request.

Please ensure vendor or product exists in the Products and Sources list cve.mitre.org/cve/data_sources_product_coverage.html

A CVE number is a way of alerting the public to an issue in applications they might use. It is not a posterity number.

You should contact the responsible persons for maintaining the system and disclose it as soon as possible to them, so that the risk that a malicious actor might find what you have found is minimized.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .