.
No Additional PropertiesThe single version being described, or the version at the start of the range. By convention, typically 0 denotes the earliest possible version.
Must be at least 1 characters long
Must be at most 1024 characters long
The vulnerability status for the version or range of versions. For a range, the status may be refined by the 'changes' list.
Same definition as defaultStatusThe version numbering system used for specifying the range. This defines the exact semantics of the comparison (less-than) operation on versions, which is required to understand the range itself. 'Custom' indicates that the version type is unspecified and should be avoided whenever possible. It is included primarily for use in conversion of older data files.
Must be at least 1 characters long
Must be at most 128 characters long
"custom"
+ .
The single version being described, or the version at the start of the range. By convention, typically 0 denotes the earliest possible version.
Must be at least 1 characters long
Must be at most 1024 characters long
The vulnerability status for the version or range of versions. For a range, the status may be refined by the 'changes' list.
Same definition as defaultStatusThe version numbering system used for specifying the range. This defines the exact semantics of the comparison (less-than) operation on versions, which is required to understand the range itself. 'Custom' indicates that the version type is unspecified and should be avoided whenever possible. It is included primarily for use in conversion of older data files.
Must be at least 1 characters long
Must be at most 128 characters long
"custom"
"git"
"maven"
"python"
"rpm"
"semver"
-The non-inclusive upper limit of the range. This is the least version NOT in the range. The usual version syntax is expanded to allow a pattern to end in an asterisk (*), indicating an arbitrarily large number in the version ordering. For example, {version: 1.0 lessThan: 1.*} would describe the entire 1.X branch for most range kinds, and {version: 2.0, lessThan: *} describes all versions starting at 2.0, including 3.0, 5.1, and so on. Only one of lessThan and lessThanOrEqual should be specified.
The inclusive upper limit of the range. This is the greatest version contained in the range. Only one of lessThan and lessThanOrEqual should be specified. For example, {version: 1.0, lessThanOrEqual: 1.3} covers all versions from 1.0 up to and including 1.3.
A list of status changes that take place during the range. The array should be sorted in increasing order by the 'at' field, according to the versionType, but clients must re-sort the list themselves rather than assume it is sorted.
Must contain a minimum of 1 items
All items must be unique
The start of a single status change during the range.
No Additional PropertiesThe new status in the range starting at the given version.
Same definition as defaultStatusThis is problem type information (e.g. CWE identifier). Must contain: At least one entry, can be text, OWASP, CWE, please note that while only one is required you can use more than one (or indeed all three) as long as they are correct). (CNA requirement: [PROBLEMTYPE]).
Must contain a minimum of 1 items
All items must be unique
Must contain a minimum of 1 items
All items must be unique
Text description of problemType, or title from CWE or OWASP.
Must be at least 1 characters long
Must be at most 4096 characters long
CWE ID of the CWE that best describes this problemType entry.
Must match regular expression:^CWE-[1-9][0-9]*$ Must be at least 5 characters long
Must be at most 9 characters long
Problemtype source, text, OWASP, CWE, etc.,
Must be at least 1 characters long
Must be at most 128 characters long
This is reference data in the form of URLs or file objects (uuencoded and embedded within the JSON file, exact format to be decided, e.g. we may require a compressed format so the objects require unpacking before they are "dangerous").
Same definition as referencesThis is reference data in the form of URLs or file objects (uuencoded and embedded within the JSON file, exact format to be decided, e.g. we may require a compressed format so the objects require unpacking before they are "dangerous").
Must contain a minimum of 1 items
Must contain a maximum of 512 items
All items must be unique
The uniform resource locator (URL), according to RFC 3986, that can be used to retrieve the referenced resource.
Same definition as collectionURLUser created name for the reference, often the title of the page.
Must be at least 1 characters long
Must be at most 512 characters long
Collection of impacts of this vulnerability.
Must contain a minimum of 1 items
All items must be unique
This is impact type information (e.g. a text description.
No Additional PropertiesCAPEC ID that best relates to this impact.
Must match regular expression:^CAPEC-[1-9][0-9]{0,4}$ Must be at least 7 characters long
Must be at most 11 characters long
Prose description of the impact scenario. At a minimum provide the description given by CAPEC.
Same definition as descriptionsCollection of impact scores with attribution.
Must contain a minimum of 1 items
All items must be unique
This is impact type information (e.g. a text description, CVSSv2, CVSSv3, CVSSV4, etc.). Must contain: At least one entry, can be text, CVSSv2, CVSSv3, others may be added.
No Additional PropertiesName of the scoring format. This provides a bit of future proofing. Additional properties are not prohibited, so this will support the inclusion of proprietary formats. It also provides an easy future conversion mechanism when future score formats become part of the schema. example: cvssV44, format = 'cvssV44', other = cvssV4_4 JSON object. In the future, the other properties can be converted to score properties when they become part of the schema.
Must be at least 1 characters long
Must be at most 64 characters long
Description of the scenarios this metrics object applies to. If no specific scenario is given, GENERAL is used as the default and applies when no more specific metric matches.
Must contain a minimum of 1 items
All items must be unique
Description of the scenario this metrics object applies to. If no specific scenario is given, GENERAL is used as the default and applies when no more specific metric matches.
Must be at least 1 characters long
Must be at most 4096 characters long
Value must be greater or equal to 0.0 and lesser or equal to 0.0
"NONE" Value must be greater or equal to 0.1 and lesser or equal to 3.9 and a multiple of 0.1
"LOW" Value must be greater or equal to 4.0 and lesser or equal to 6.9 and a multiple of 0.1
"MEDIUM" Value must be greater or equal to 7.0 and lesser or equal to 8.9 and a multiple of 0.1
"HIGH" Value must be greater or equal to 9.0 and lesser or equal to 10 and a multiple of 0.1
"CRITICAL" CVSS Version
^CVSS:4[.]0/AV:[NALP]/AC:[LH]/AT:[NP]/PR:[NLH]/UI:[NPA]/VC:[HLN]/VI:[HLN]/VA:[HLN]/SC:[HLN]/SI:[HLN]/SA:[HLN](/E:[XAPU])?(/CR:[XHML])?(/IR:[XHML])?(/AR:[XHML])?(/MAV:[XNALP])?(/MAC:[XLH])?(/MAT:[XNP])?(/MPR:[XNLH])?(/MUI:[XNPA])?(/MVC:[XNLH])?(/MVI:[XNLH])?(/MVA:[XNLH])?(/MSC:[XNLH])?(/MSI:[XNLHS])?(/MSA:[XNLHS])?(/S:[XNP])?(/AU:[XNY])?(/R:[XAUI])?(/V:[XDC])?(/RE:[XLMH])?(/U:(X|Clear|Green|Amber|Red))?$ CVSS Version
^CVSS:3[.]1/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$ Value must be greater or equal to 0 and lesser or equal to 10
CVSS Version
^CVSS:3[.]0/((AV:[NALP]|AC:[LH]|PR:[UNLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XUNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[UNLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XUNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$ Value must be greater or equal to 0 and lesser or equal to 10
CVSS Version
^((AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))/)*(AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))$ Value must be greater or equal to 0 and lesser or equal to 10
A non-standard impact description, may be prose or JSON block.
No Additional PropertiesName of the non-standard impact metrics format used.
Must be at least 1 characters long
Must be at most 128 characters long
JSON object not covered by another metrics format.
Configurations required for exploiting this vulnerability.
Must contain a minimum of 1 items
All items must be unique
Text in a particular language with optional alternate markup or formatted representation (e.g., Markdown) or embedded media.
Same definition as descriptionWorkarounds and mitigations for this vulnerability.
Must contain a minimum of 1 items
All items must be unique
Text in a particular language with optional alternate markup or formatted representation (e.g., Markdown) or embedded media.
Same definition as descriptionInformation about solutions or remediations available for this vulnerability.
Must contain a minimum of 1 items
All items must be unique
Text in a particular language with optional alternate markup or formatted representation (e.g., Markdown) or embedded media.
Same definition as descriptionInformation about exploits of the vulnerability.
Must contain a minimum of 1 items
All items must be unique
Text in a particular language with optional alternate markup or formatted representation (e.g., Markdown) or embedded media.
Same definition as descriptionThis is timeline information for significant events about this vulnerability or changes to the CVE Record.
Must contain a minimum of 1 items
All items must be unique
Timestamp representing when the event in the timeline occurred. The timestamp format is based on RFC3339 and ISO ISO8601, with an optional timezone. yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM - if the timezone offset is not given, GMT (+00:00) is assumed.
Same definition as dateUpdatedThe language used in the description of the event. The language field is included so that CVE Records can support translations. The value must be a BCP 47 language code.
Same definition as langA summary of the event.
Must be at least 1 characters long
Must be at most 4096 characters long
Statements acknowledging specific people, organizations, or tools recognizing the work done in researching, discovering, remediating or helping with activities related to this CVE.
Must contain a minimum of 1 items
All items must be unique
The language used when describing the credits. The language field is included so that CVE Records can support translations. The value must be a BCP 47 language code.
Same definition as langMust be at least 1 characters long
Must be at most 4096 characters long
UUID of the user being credited if present in the CVE User Registry (optional). This UUID can be used to lookup the user record in the user registry service.
Same definition as assignerOrgIdType or role of the entity being credited (optional). finder: identifies the vulnerability.
reporter: notifies the vendor of the vulnerability to a CNA.
analyst: validates the vulnerability to ensure accuracy or severity.
coordinator: facilitates the coordinated response process.
remediation developer: prepares a code change or other remediation plans.
remediation reviewer: reviews vulnerability remediation plans or code changes for effectiveness and completeness.
remediation verifier: tests and verifies the vulnerability or its remediation.
tool: names of tools used in vulnerability discovery or identification.
sponsor: supports the vulnerability identification or remediation activities.
This is the source information (who discovered it, who researched it, etc.) and optionally a chain of CNA information (e.g. the originating CNA and subsequent parent CNAs who have processed it before it arrives at the MITRE root).
Must contain: IF this is in the root level it MUST contain a CNA_chain entry, IF this source entry is NOT in the root (e.g. it is part of a vendor statement) then it must contain at least one type of data entry.
List of taxonomy items related to the vulnerability.
Must contain a minimum of 1 items
All items must be unique
A taxonomy mapping object identifies the taxonomy by a name and version (eg., ATT&CK v13.1, CVSS 3.1, CWE 4.12) along with a list of relations relevant to this CVE.
No Additional PropertiesThe name of the taxonomy, eg., ATT&CK, D3FEND, CWE, CVSS
Must be at least 1 characters long
Must be at most 128 characters long
The version of taxonomy the identifiers come from.
Must be at least 1 characters long
Must be at most 128 characters long
List of relationships to the taxonomy for the vulnerability.
Must contain a minimum of 1 items
All items must be unique
A relationship between the taxonomy and the CVE or two taxonomy items.
No Additional PropertiesIdentifier of the item in the taxonomy. Used as the subject of the relationship.
Must be at least 1 characters long
Must be at most 2048 characters long
A description of the relationship.
Must be at least 1 characters long
Must be at most 128 characters long
The target of the relationship. Can be the CVE ID or another taxonomy identifier.
Must be at least 1 characters long
Must be at most 2048 characters long
All property whose name matches the following regular expression must respect the following conditions
Property name regular expression:^x_[^.]*$ Must contain a minimum of 1 items
All items must be unique
An object containing the vulnerability information provided by an Authorized Data Publisher (ADP). Since multiple ADPs can provide information for a CVE ID, an ADP container must indicate which ADP is the source of the information in the object.
No Additional PropertiesDetails related to the information container provider (CNA or ADP).
Same definition as providerMetadataIf known, the date/time the vulnerability was disclosed publicly.
Same definition as dateUpdatedA title, headline, or a brief phrase summarizing the information in an ADP container.
Must be at least 1 characters long
Must be at most 256 characters long
A list of multi-lingual descriptions of the vulnerability. E.g., [PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]. OR [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] [ROOT CAUSE], which allows [ATTACKER] to [IMPACT] via [VECTOR].
Same definition as descriptionsThis is problem type information (e.g. CWE identifier). Must contain: At least one entry, can be text, OWASP, CWE, please note that while only one is required you can use more than one (or indeed all three) as long as they are correct). (CNA requirement: [PROBLEMTYPE]).
Same definition as problemTypesThis is reference data in the form of URLs or file objects (uuencoded and embedded within the JSON file, exact format to be decided, e.g. we may require a compressed format so the objects require unpacking before they are "dangerous").
Same definition as referencesConfigurations required for exploiting this vulnerability.
Same definition as configurationsInformation about solutions or remediations available for this vulnerability.
Same definition as solutionsThis is timeline information for significant events about this vulnerability or changes to the CVE Record.
Same definition as timelineStatements acknowledging specific people, organizations, or tools recognizing the work done in researching, discovering, remediating or helping with activities related to this CVE.
Same definition as creditsThis is the source information (who discovered it, who researched it, etc.) and optionally a chain of CNA information (e.g. the originating CNA and subsequent parent CNAs who have processed it before it arrives at the MITRE root).
Must contain: IF this is in the root level it MUST contain a CNA_chain entry, IF this source entry is NOT in the root (e.g. it is part of a vendor statement) then it must contain at least one type of data entry.
List of taxonomy items related to the vulnerability.
Same definition as taxonomyMappingsAll property whose name matches the following regular expression must respect the following conditions
Property name regular expression:^x_[^.]*$ If the CVE ID and associated CVE Record should no longer be used, the CVE Record is placed in the Rejected state. A Rejected CVE Record remains on the CVE List so that users can know when it is invalid.
No Additional PropertiesIndicates the type of information represented in the JSON instance.
Same definition as dataTypeThe version of the schema being used. Used to support multiple versions of this format.
Same definition as dataVersionThis is meta data about the CVE ID such as the CVE ID, who requested it, who assigned it, when it was requested, the current state (PUBLISHED, REJECTED, etc.) and so on. These fields are controlled by the CVE Services.
No Additional PropertiesThe UUID for the organization to which the CVE ID was originally assigned.
Same definition as assignerOrgIdThe short name for the organization to which the CVE ID was originally assigned.
Same definition as assignerShortNameThe system of record causes this to start at 1, and increment by 1 each time a submission from a data provider changes this CVE Record. The incremented value moves to the Rejected schema upon a PUBLISHED->REJECTED transition, and moves to the Published schema upon a REJECTED->PUBLISHED transition.
Value must be greater or equal to 1
The date/time the CVE Record was first published in the CVE List.
Same definition as dateUpdatedState of CVE - PUBLISHED, REJECTED.
The date/time this CVE ID was reserved in the CVE automation workgroup services system. Disclaimer: This date reflects when the CVE ID was reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Same definition as dateUpdatedA set of structures (called containers) used to store vulnerability information related to a specific CVE ID provided by a specific organization participating in the CVE program. Each container includes information provided by a different source.
At minimum, a 'cna' container containing the vulnerability information provided by the CNA who initially assigned the CVE ID must be included.
There can only be one 'cna' container, as there can only be one assigning CNA.
An object containing the vulnerability information provided by a CVE Numbering Authority (CNA) for a rejected CVE ID. There can only be one CNA container per CVE record since there can only be one assigning CNA.
No Additional PropertiesDetails related to the information container provider (CNA or ADP).
Same definition as providerMetadataContains an array of CVE IDs that this CVE ID was rejected in favor of because this CVE ID was assigned to the vulnerabilities.
Must contain a minimum of 1 items
All items must be unique
All property whose name matches the following regular expression must respect the following conditions
Property name regular expression:^x_[^.]*$