Skip to main content

Common Vulnerabilities and Exposures (CVEs)

CVEs (Common Vulnerabilities and Exposures) are standardized identifiers for publicly known cybersecurity vulnerabilities which can be leveraged in exploits. The MITRE Corporation manages the CVE program, which receives funding from the U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA).

Identifiers​

Each CVE has a unique identifier. For example: CVE-2022-22965 which is the Spring4Shell vulnerability from 2022:

"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it." - CVE-2022-22965, NIST

Severity (CVSS)​

The Common Vulnerability Scoring System (CVSS) is a score assigned to each vulnerability, in the range 0-10. CVE-2022-22965 received a base score of 9.8 (critical).

Weakness Enumeration (CWE)​

CWE (Common Weakness Enumeration) is a community-driven taxonomy that categorizes and describes software weaknesses and vulnerabilities. CVE-2022-22965 is in the category of "code injection", and is assigned CWE-94:

CWE-94: Improper Control of Generation of Code ('Code Injection'). The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. - CWE-94, Mitre.org

Categories​

CWEs are further aggregated into categories. For example CWE-94 belongs in the category "Data Neutralisation Issues".

In order to bring AppSec issues to the attention of developers, security experts and administrators, OWASP produces an annual "Top-10" list of the most important categories to consider. For example A03:2021 - Injection includes CWE-94 from above, but also issues like SQL injection and cross-site scripting.

Software Inventory

Software inventory is a precondition to most of the activities involved in OSMM level 2. The first step to licence compliance or supply chain security is to understand what software is in your estate.

Open Source Supply Chain Security

In this article we are going to look at the growing issue of software supply chain attacks via some examples and then look at the emerging field of open source supply chain security: what it is, current best practices, the institutional landscape and emerging legislation.

Further Reading​