CVE (Common Vulnerabilities and Exposures)

CVE, short for Common Vulnerabilities and Exposures, is the public catalogue of known software flaws, in which every flaw gets its own number. A vulnerability is a flaw that lets an attacker make software do something it should not allow, such as run the attacker's own code. Each CVE entry gives the flaw a number such as CVE-2021-44228: the year it was numbered, then a serial number. The entry also names the affected product and versions, and links to the maker's fix. The list is run by MITRE, a non-profit organisation, and it has been kept since 1999.

Here is how a flaw gets onto the list. A researcher, or the software maker itself, finds the flaw. It is reported to a CVE Numbering Authority, an organisation allowed to hand out numbers; most large software makers are one. The number is reserved while the maker builds a fix, called a patch. When the patch is ready, the entry is published. Databases then add a severity score, called the CVSS score, from 0 to 10. A score of 9.0 or more is called critical.

Why does a number matter? Every party can now refer to exactly the same flaw: the maker's notice, a vulnerability scanner, an advisory from CERT-In, India's national cyber security agency, and the company's own ticket to fix it. Tens of thousands of CVEs are published every year, so no company can fix all of them at once. Vulnerability intelligence tracks which ones attackers are actually using.

Take, for example, a hospital's IT team that reads a CERT-In advisory about a critical CVE in its remote-access gateway. Patch management installs the fix on that gateway before anything else.

Consider a developer whose app uses dozens of open-source libraries. Software composition analysis checks each library's version against the CVE list and stops the build if one carries a critical flaw.

Say an online shop cannot patch its web server until the weekend. Its web application firewall adds a rule that blocks requests trying to use that one CVE.

How is a CVE different from a zero-day? A zero-day is a flaw that attackers use before the maker knows about it, so no patch exists yet, and often no CVE number either. A CVE is a flaw that is already known and named, and usually already has a fix. Many successful attacks use old CVEs that were never patched, not zero-days.