CVE

CVE (Common Vulnerabilities and Exposures) is a system that assigns unique identifiers (CVE-YYYY-NNNN) to publicly disclosed security vulnerabilities, maintained by MITRE.

Purpose

To give vulnerabilities unified identifiers so security tools, advisories, and fixes can reference the same vulnerability precisely.

Mechanism

The CVE number format is CVE-year-sequence (e.g., CVE-2021-44228 Log4Shell). CNAs (CVE Numbering Authorities) assign the numbers. The NVD (National Vulnerability Database) records CVEs and attaches CVSS scores and affected products. The number itself carries no details; look them up in NVD/MITRE.

Use cases

Vulnerability tracking and remediation
Security advisory references
Dependency scanning matches
Compliance reporting

Examples

Input

CVE-2021-44228

Output

Log4Shell RCE vulnerability

Log4j remote code execution

Common errors

Judging severity by the CVE number alone: Check the NVD CVSS score and affected versions

Related terms

CVSS (Common Vulnerability Scoring System) is a standardized scoring system for vulnerability severity, outputting 0-10 scores and maintained by FIRST.

OWASP (Open Web Application Security Project) is a nonprofit organization that publishes the Top 10 Web vulnerability list and security practice guides; it is an authority on Web security.

Penetration Testing

Penetration testing is simulating attacker behavior to run authorized attack tests against a system, discovering exploitable vulnerabilities and assessing real risk.

References