Which scheme for identifying vulnerabilities was developed by MITRE and adopted by NIST?

Which scheme for identifying vulnerabilities was developed by MITRE and adopted by NIST?

• A. CVE
• B. CVSS
• C. SCAP
• D. Vulnerability feed

Answer: (A)

Identifying vulnerabilities with a universal labeling enables vendors, researchers, and tools to talk about the same issue unambiguously. MITRE created the Common Vulnerabilities and Exposures (CVE) list to assign a unique identifier to publicly disclosed security vulnerabilities. This naming scheme is widely adopted by NIST, which uses CVE IDs in the National Vulnerability Database to catalogue, cross-link, and reference vulnerabilities across advisories, patches, and scans. This standardization allows interoperability between vulnerability scanners, databases, and reporting tools. By contrast, CVSS is a separate scoring framework used to rate severity (for example, base and temporal scores), not to identify the vulnerability itself. SCAP is a broader automation framework that uses CVE and CVSS data to automate vulnerability management workflows. A vulnerability feed is a general term for sources of vulnerability information, which may include CVE entries but is not itself the identification scheme.

Identifying vulnerabilities with a universal labeling enables vendors, researchers, and tools to talk about the same issue unambiguously. MITRE created the Common Vulnerabilities and Exposures (CVE) list to assign a unique identifier to publicly disclosed security vulnerabilities. This naming scheme is widely adopted by NIST, which uses CVE IDs in the National Vulnerability Database to catalogue, cross-link, and reference vulnerabilities across advisories, patches, and scans. This standardization allows interoperability between vulnerability scanners, databases, and reporting tools.

By contrast, CVSS is a separate scoring framework used to rate severity (for example, base and temporal scores), not to identify the vulnerability itself. SCAP is a broader automation framework that uses CVE and CVSS data to automate vulnerability management workflows. A vulnerability feed is a general term for sources of vulnerability information, which may include CVE entries but is not itself the identification scheme.