I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this purpose. I keep encountering situations where recently published CVEs are without CPEs for Known Affected Software Configurations.

Example at time of writing is CVE-2021-0295 (JSON API)

"result": {
   "CVE_Items": [{
      "configurations": {
          "CVE_data_version": "4.0",
          "nodes": []

Example of CVE with CPEs is CVE-2020-24563 (JSON API)

How can I properly utilise CPEs for determining the applicability of newly published CVEs? Am I stuck with having to utilise keyword matching for these situations? Are there certain timetables I should be aware of?


1 Answer 1


Under Collaborative Vulnerability Metadata Acceptance Process (CVMAP) for CVE Numbering Authorities (CNAs) and Authorized Data Publishers (NISTIR 8246), Section 4:

The current NVD analyst workflow for a single CVE record consists of two primary stages:

  1. Initial Analysis and
  2. Verification.

Initial Analysis involves an NVD analyst investigating the information provided for the CVE record to better understand the vulnerability’s characteristics. This analysis is primarily focused on the CVE description and attached resource links to external publicly verifiable information. From this information, the NVD analyst develops initial CVSSv2 and CVSSv3.1 vector strings, associates CWE(s) with the CVE record, determines the appropriate Reference Link Tags, and builds the configurations using matching criteria defined in the Common Platform Enumeration (CPE) 2.3 specification.

Once the Initial Analysis is complete, the analyzed metadata for the CVE record is then reviewed by a second—usually more experienced—NVD analyst during the Verification stage. This ensures that proper standards and procedures have been applied to the analysis of CVE record metadata based on the information supplied. Once the analyzed CVE record has been reviewed and approved, the CVE record metadata is then published for public access.

Under the Collaborative Vulnerability Metadata Acceptance Process (CVMAP), Section 10.5 it is stated:

Configuration assessments are not yet occurring as part of CVMAP. We will make an announcement when this functionality is officially included.

It would seem one is at the mercy of the timetable of NVD analysts for a CVE's CPE information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .