CVE (Common Vulnerabilities and Exposures)

A CVE (Common Vulnerabilities and Exposures) is a standardized identifier in the form CVE-YEAR-NUMBER given to a specific publicly known security flaw, so everyone can refer to the same issue consistently.

Why it matters

CVE IDs let vendors, scanners, advisories and administrators match a flaw to affected products and fixes. Databases such as the NVD add severity scores and details. A CVE entry identifies a vulnerability, it does not say how bad it is or whether a patch exists, so you still need to read the advisory.

Example

CVE-2021-44228 is the identifier for the Log4Shell flaw in the Apache Log4j library. Searching that ID returns vendor advisories, affected versions and the fixed releases.

Common mistakes

• Assuming every vulnerability has a CVE. Many are never assigned one.
• Reading a high CVSS score as the same thing as high risk for your environment.
• Ignoring CVEs in dependencies because you did not write the code.

Related

• Vulnerability
• Patch
• Zero-day
• Security audit

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.