8

Why do some known vulnerabilities have no CVE ID? And why does some vulnerability have a CVE ID assigned but no information on cve.mitre.org or cvedetail.com?

  • 1
    Can you point to specific examples to make your question more concrete? Otherwise, it's likely going to be hard to answer this question. – D.W. Nov 7 '14 at 17:51
13

Why don't some vulnerabilities have CVE numbers?
It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system.

Why are CVE entries sometimes empty?
The CVE number assignment procedure specifies that the CVE number requester should notify MITRE about the public advisory, and then MITRE would update the CVE entry. Sometimes a CVE requester (usually a vendor) would ask for a CVE, and then neglects to notify MITRE, release an advisory containing a patch without any details, or simply just delay informing MITRE. In these cases, the entry will remain mostly empty until the requester provides more information.

In any case, it's up to the CVE number requester to request the number and then provide information to be filled in the entry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.