[et_pb_section fb_built=”1″ _builder_version=”4.22.0″ _module_preset=”default” custom_margin=”0px||||false|false” custom_padding=”0px||||false|false” locked=”off” global_colors_info=”{}”][et_pb_row column_structure=”1_4,3_4″ _builder_version=”4.22.0″ _module_preset=”default” custom_padding=”50px||||false|false” global_colors_info=”{}”][et_pb_column type=”1_4″ disabled_on=”on|on|off” _builder_version=”4.22.0″ _module_preset=”default” custom_padding=”||||false|false” sticky_position=”top” sticky_offset_top=”100px” sticky_limit_bottom=”body” motion_trigger_start=”top” global_colors_info=”{}”][et_pb_text admin_label=”indice” _builder_version=”4.22.0″ _module_preset=”default” custom_margin=”||500px||false|false” custom_padding=”||||false|false” link_option_url=”#1″ sticky_position=”top” sticky_limit_bottom=”section” sticky_offset_surrounding=”off” sticky_transition=”off” global_colors_info=”{}”]<\/p>\n
Sections<\/strong><\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”4.22.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text admin_label=”seccion” module_id=”1″ module_class=”ittopicscontent” _builder_version=”4.22.0″ _module_preset=”default” z_index=”0″ custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||false|false” custom_css_main_element=”font-family:%22Pandora-Light%22;” locked=”off” global_colors_info=”{}”]A CVE, or Common Vulnerabilities and Exposures, is a unique, standardized identification for a security vulnerability or exposure in software or hardware. CVEs are a naming and tracking system used around the world to identify and list specific security vulnerabilities. This system was created to make it easier to organize, communicate, and reference vulnerability information, allowing the IT security community and IT professionals to address and fix security issues more efficiently.<\/p>\n Common Vulnerability and Exposure Identifiers (CVE) supervision falls on MITRE Corporation<\/span><\/a>, with the financial backing of the Cybersecurity and Infrastructure Security Agency (CISA), an entity belonging to the United States Department of Homeland Security.<\/p>\n CVE entries are concise and do not contain technical details or information about risks, impact or solutions. Such information is found in other databases, such as the National Vulnerability Database (NVD)<\/span><\/a> of the United States, the CERT\/CC Vulnerability Notes Data<\/span><\/a> and multiple lists maintained by vendors and other companies.<\/p>\n These CVE identification numbers play a critical role in enabling users to reliably identify unique vulnerability spots and make coordination easier in security solution and tool development for multiple systems. The MITRE Corporation is responsible for maintaining the CVE list<\/a>, although it is frequently companies and members of the open source community who report security flaws that become CVEs.<\/p>\n CVE identifiers are assigned by CVE Numbering Authorities (CNAs). Currently, there are 327 CNAs <\/a>(325 CNAs y 2 CNA-LRs) out of 37 countries<\/a> participating in the CVE Program representing major information technology vendors, as well as security companies and research institutions. In this sense, Pandora FMS is in contact with security researchers who inform the company about vulnerabilities they detected, providing details such as date and time when the security breach was identified, affected versions, type of security to report (XSS, CSRF, SQLi, RCE), affected components (API, agent, server, among others), screenshots or transaction logs and instructions to reproduce the problem, following their vulnerability disclosure and management policies<\/span><\/a>. It is worth mentioning that we ask the researcher not to publish the details of the vulnerability, having to first analyze the problem, reproduce the bug and determine the prioritization for its correction. Once the problem is corrected, together with the Researcher, the response to the community is managed and the correction made in an official version of CVE<\/span><\/a>, indicating the CVE Code, the details of the vulnerability, certification date and version that was fixed.<\/p>\n It is noteworthy that CVE reports not only come from researchers, but rather they may come from anyone who discovers a vulnerability and reports it, whether it is a vendor, a researcher, or just a wise user. In fact, many vendors offer rewards for discovering security flaws to encourage responsible disclosure. If a vulnerability is found in open source software systems, it is important to notify the community.<\/p>\n\n
How does the CVE system work?<\/h2>\n
CVE identifiers<\/h2>\n