The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the
Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. NVD includes databases of security checklists, security related software flaws, misconfigurations, product names, and impact metrics. NVD supports the
Information Security Automation Program
The Information Security Automation Program (ISAP, pronounced “I Sap”) is a U.S. government multi-agency initiative to enable automation and standardization of technical security operations. While a U.S. government initiative, its standards bas ...
(ISAP). NVD is managed by the U.S. government agency the
National Institute of Standards and Technology
The National Institute of Standards and Technology (NIST) is an agency of the United States Department of Commerce whose mission is to promote American innovation and industrial competitiveness. NIST's activities are organized into Outline of p ...
(NIST).
On Friday March 8, 2013, the database was taken offline after it was discovered that the system used to run multiple government sites had been compromised by a software vulnerability of
Adobe ColdFusion.
The vulnerabilities in the NVD originate from the
Common Vulnerabilities and Exposures (CVE) list, maintained by
MITRE. New vulnerabilities are assigned by MITRE and CVE Numbering Authorities and subsequently added to the NVD.
CVE Enrichment
When vulnerabilities are added to the list of
Common Vulnerabilities and Exposures (CVEs), the NVD assigns them a score using the
Common Vulnerability Scoring System (CVSS). This score is based on metrics such as access complexity and potential impact, allowing organizations to prioritize remediation efforts depending on the severity.
In June 2017, threat intel firm
Recorded Future revealed that the median lag between a CVE being revealed to ultimately being published to the NVD is 7 days and that 75% of vulnerabilities are published unofficially before making it to the NVD, giving attackers time to exploit the vulnerability.
In August 2023, the NVD initially marked an integer overflow bug in old versions of
cURL as a 9.8 out of 10 critical vulnerability. cURL lead developer
Daniel Stenberg responded by saying this was not a security problem, the bug had been patched nearly 4 years prior, requested the CVE be rejected, and accused NVD of "scaremongering" and "grossly inflating the severity level of issues". MITRE disagreed with Stenberg and denied his request to reject the CVE, noting that "there is a valid weakness ... which can lead to a valid security impact."
In September 2023, the issue was rescored by the NVD as a 3.3 "low" vulnerability, stating that "it may (in theory) cause a denial of service" for attacked systems, but that this attack vector "is not especially plausible".
See also
*
Common Weakness Enumeration
*
Common Vulnerabilities and Exposures
*
Software composition analysis
References
External links
*
Security Content Automation Protocol (SCAP)Packet StormExploit Database
Security Content Database
Government databases in the United States
Security vulnerability databases
{{US-gov-stub