What is a CVE? 🤔 Common Vulnerabilities and Exposures

Cybersecurity – a field full of abbreviations and technical terms that often confuse more than they explain. However, one term you should be familiar with is CVE. Hidden behind these three letters is something quite crucial for our digital security: “Common Vulnerabilities and Exposures”. But what does this mean in concrete terms, and why should we care? Quite simply, CVEs are like a kind of public notice board where known vulnerabilities are collected and categorized – for experts and for anyone who wants to keep their systems secure. In this article, we take a look at what exactly CVEs are, how they work and what role they play in modern cyber security.

What is a CVE?

Think of CVE as a huge public list or database in which all known vulnerabilities and security gaps in software and systems are collected. CVE stands for “Common Vulnerabilities and Exposures”. The idea behind it is quite simple: when a security vulnerability is discovered, it ends up in this list under a unique CVE number. This is like a fingerprint for each vulnerability – there are never two identical CVEs, each vulnerability is uniquely identified.

Why are CVEs important? And what is CVE used for?

This centralized list helps developers, admins, IT professionals and security experts worldwide to know exactly which vulnerabilities are known and where they could occur. This allows them to search for security vulnerabilities and fix them as quickly as possible before someone exploits them. Imagine someone discovers that certain versions of programs such as WordPress or MS Exchange have a vulnerability – they could be hacked or attacked. As soon as this is reported as a CVE, everyone knows: watch out, there’s a gap here!

A CVE entry essentially consists of the CVE number, a brief description of the vulnerability and often a reference to how dangerous the gap could be. This allows security people to quickly orient themselves and react accordingly. The aim? To keep systems secure, keep an eye on threats and protect us all a little better from cyber attacks.

What does a CVE look like?

A CVE entry is like a profile of a specific vulnerability. It contains all the important information needed to understand what exactly the vulnerability is, where it occurs and how dangerous it could be. Let’s take a closer look at the example of CVE-2024-31111 – this is a vulnerability in WordPress that affects cross-site scripting (XSS for short).

1. CVE-ID

The ID “CVE-2024-31111” is like a unique serial number for the vulnerability. It consists of the year in which the vulnerability was reported (2024) and an individual number (31111). This number is unique worldwide for this vulnerability.

2. Description of the vulnerability

Here is what it is specifically about: This CVE is a so-called “Improper Neutralization of Input During Web Page Generation”, i.e. user input is not properly filtered before it is displayed on a web page. This creates an XSS vulnerability that allows attackers to inject their own JavaScript code into websites in order to harm other users. Specifically, it affects various versions of WordPress (6.5 to 5.9.9).

3. Affected software and versions

This section lists all affected versions of WordPress – ranging from version 6.5 down to 5.9.9. If you are using WordPress and your version is on the list, your system is potentially at risk.

4. Available patches and sources

Often there are links to the official website or other sources that provide details or updates on the vulnerability. In this case, there are links to Patchstack and WordPress News, which explain more about the patch and the vulnerability.

5. Category and technical details

The vulnerability belongs to the “Cross Site Scripting (XSS)” category – a very common type of attack in which malicious scripts are injected. There is also the “CWE-ID” (Common Weakness Enumeration), in this case CWE-79, which indicates that this is a known vulnerability type.

6. EPSS score and CVSS scores

This indicates the probability that the vulnerability will be exploited in the near future. The “EPSS score” for CVE-2024-31111 is 0.04%, which indicates a low probability of attacks. There is also the “CVSS score”, which classifies the level of danger – here the score is 6.5, which is considered “medium”. This score shows that the vulnerability is serious but not catastrophic.

Where can I find CVE details?

If you’re looking for CVE details, there are a few reliable places to go that will provide you with everything you need to know about known vulnerabilities. The best known are CVE.org and the National Vulnerability Database (NVD) – both public databases that are updated around the clock and provide you with a lot of information on each CVE number. Here you can simply enter the CVE ID (e.g. CVE-2024-31111) in the search bar and you will receive details of the vulnerability, affected versions and often also possible updates or patches.

CVE.org is practically the official site when it comes to CVEs. It provides you with basic information such as a description, the CVE status (e.g. whether it is still being investigated or has been confirmed) and links to further resources. Perfect if you need a quick overview.

The National Vulnerability Database (NVD) goes even deeper. In addition to the basic description, you will also find detailed assessments of how dangerous the vulnerability is and technical details, e.g. how easy it is to exploit. The NVD also assigns the “CVSS score”, which indicates how critical the vulnerability is, and provides information on how likely an exploit is.

There are also specialized sites such as Mitre and Patchstack, which sometimes offer detailed information for specific products or industries. Security blogs and the official websites of manufacturers (such as Microsoft or WordPress) are also often helpful, as they often publish updates and security advisories for their products.

In short, CVE.org and the NVD are your best friends if you want to look up a vulnerability. And if you need additional information, it’s worth taking a look at the manufacturer’s website or specialized security platforms.

What is the CVE score?

The CVE score is, so to speak, the threat level of a security vulnerability – it shows on a scale of 0 to 10 how serious or critical a vulnerability is. The higher the score, the more dangerous the vulnerability is and the more important it is to fix it quickly. This score is calculated using the CVSS (Common Vulnerability Scoring System), a system used worldwide to assess vulnerabilities.

Think of the CVE score as a school grade that takes various criteria into account: How easy is the vulnerability to exploit? Does a hacker need to have special access rights? What impact would an attack have on the confidentiality, integrity or availability of the system? All of this is included in the score, which is then categorized as “low”, “medium”, “high” or “critical”.

Example: A score of 3.5 would be “low”, as the vulnerability is unlikely to be easily exploited or would only have a minor impact. A score of 9.8, on the other hand, is “critical” and indicates that the vulnerability would be very easy to exploit and have a major impact. This makes you want to install an update or patch immediately!

This rating is extremely useful for admins and IT teams because they can quickly identify which vulnerabilities have top priority. Many CVE databases, such as the NVD, also list the CVE score so that you can immediately get a feel for how seriously a security vulnerability should be taken.

CVE vs. CWE

“CVE” and ‘CWE’ sound similar and both have to do with vulnerabilities, but they’re not the same thing. The main difference? CVE stands for a very specific vulnerability in a particular system or software, while CWE describes more the fundamental problem, i.e. the type of vulnerability that can exist in general.

CVE (Common Vulnerabilities and Exposures) is a unique identifier for a single, specific vulnerability that has appeared somewhere. Imagine someone discovers a bug in a specific version of WordPress that can lead to cross-site scripting (XSS) – this is reported as a CVE, let’s say CVE-2024-31111. This entry describes the vulnerability exactly for this specific version of WordPress.

CWE (Common Weakness Enumeration), on the other hand, classifies the general types of vulnerabilities. It is like a collection of the common “bug types” in the software world. For example, CWE-79 stands for cross-site scripting (XSS) in general, which is the basic type of vulnerability where unfiltered user input into websites can lead to malicious code. This means that CWE-79 covers all cross-site scripting vulnerabilities, regardless of the software in which they occur – whether in WordPress, a web app or elsewhere.

A practical example: CVE-2024-31111 describes the specific vulnerability in WordPress, which is categorized as CWE-79 because it is a typical XSS vulnerability. So you can see that this problem belongs to a known vulnerability type that occurs in software development in general and where you have to be vigilant as a developer.

To summarize: CVE describes the specific problem in a particular software and version, while CWE describes the general vulnerability type. Both systems complement each other and help to better understand and classify security problems.

CVE significance for companies

For companies, CVEs are like an early warning system in the world of cyber security. CVEs help companies stay informed about all known vulnerabilities in the software they use. This information is crucial to maintaining IT security and minimizing the risk of cyberattacks.

For example, if a company uses a specific version of Microsoft Exchange Server or a specific database software, CVEs can indicate if and which vulnerabilities are known in that particular version. A CVE for Microsoft Exchange, for example, could show that an attacker could gain access to sensitive emails without much outside intervention – something that companies would certainly want to prevent at all costs.

Most companies rely on a variety of software solutions – from operating systems and databases to web applications and internal tools. CVEs help them to quickly see where action is needed. When a new CVE with a high score emerges, a “patch” (a software update) is often provided by the vendor to close the vulnerability. Companies can then check their systems for the affected versions and decide which patches need to be installed urgently.

A practical example: A company that works with customer and payment data uses a specific version of Apache, a web server. If a CVE becomes known that describes a security vulnerability in this Apache version and the CVE score is high, the company must react quickly. Without the patch, attackers might be able to gain unauthorized access to the data – which would not only damage the company’s image, but also have legal consequences.

Tools to find CVEs

There are many practical tools that help to find and monitor CVEs – perfect for anyone who wants to keep an eye on security vulnerabilities in their own system. Whether companies or individual IT professionals, these tools can be used to quickly identify, analyze and fix vulnerabilities.

Here are some of the most important tools:

National Vulnerability Database (NVD)
The NVD is the “official” contact point for all registered CVEs. It is operated by the US National Institute of Standards and Technology (NIST) and offers a searchable database containing all the important information on each CVE number. There are also assessments of the danger (CVSS score) and often links to patches.
Mitre CVE List
Mitre, the organization that manages the CVE program, also provides a freely accessible CVE list. Here you can search for specific CVEs or browse through various categories to find out which vulnerabilities have currently been reported. Practical if you want to list CVEs easily and directly.
Shodan
Shodan is a search engine for networked devices and servers that links CVE information with its search results. You can use Shodan to find out whether and which vulnerabilities can be found on your own or third-party devices. This is a particularly powerful tool for security teams to check the security of networks.
Qualys
Qualys is a well-known vulnerability scanning and security monitoring tool designed specifically for organizations. It scans all systems and reports any CVEs found. It also provides security reports and suggestions on how to close gaps – ideal for use in larger IT environments.
OpenVAS
OpenVAS is an open source vulnerability detection tool that scans systems for known CVEs and reports on discovered vulnerabilities. It is a good choice if you are looking for a free solution to regularly scan for CVEs and thus reduce the risk of attacks.
Nessus
Nessus is a commercial tool that specializes in finding vulnerabilities in networks and systems. It specifically scans for CVEs and lists any vulnerabilities found, along with information on the threat level and instructions on how to fix them. Nessus is particularly popular in the corporate world because it provides detailed reports and easy-to-understand analysis.
Vulners.com
Vulners is a search engine specifically for security vulnerabilities that summarizes data from various sources (such as NVD, exploit databases and forums). You can search for specific CVEs or filter vulnerability information by software, system or even vulnerability type.

These tools can be used to quickly find and evaluate CVEs – and systematically keep an eye on security gaps.

Summary

CVE, which stands for Common Vulnerabilities and Exposures, is the VIP pass to the world of cyber security. If you want to know what these vulnerabilities are all about, then the official CVE website at CVE.org is your first stop. There you will find the entire CVE list, in which each vulnerability is given its own name. This makes the whole thing clear and ensures that everyone is in the picture when it comes to security.

But where can I find CVE details? Good question! The National Vulnerability Database (NVD) is the central CVE database that not only gives you the basic information on vulnerabilities, but also the CVE score – a kind of danger rating for each vulnerability. A high score shows you at a glance that you should act quickly to protect your system.

CVE is mainly used to help IT teams and companies keep an eye on their software and systems. So if you run a business, it’s important to know where CVEs are published. Besides the NVD and CVE.org, there are also tools like Qualys, Shodan and Nessus to help you discover the latest CVEs. The question “How many CVEs are there?” can be answered quickly: New vulnerabilities are constantly being added, so keep up to date!

Overall, CVEs are a super practical tool for making your own systems more secure and keeping cyber threats at bay. They bring order to the chaos of security gaps and give you the information you need to avoid getting lost in the digital jungle.