The Enriched CVE Record: Redefining Completeness and Quality for Greater Impact

### Overview In this talk, Alex Summers, MITRE's CVE and CWE project lead, discusses the evolution of CVE data enrichment and how expectations around CVE record completeness have transformed. Originally defined in 1999 by just three core elements—an ID, a brief description, and an external reference—CVE records now require far more contextual metadata to support modern vulnerability management. Summers highlights how the CVE Program has transitioned from centralized authoring by MITRE to a federated model empowering CVE Numbering Authorities (CNAs) to supply critical enrichment data directly at the time of disclosure.

### Key Topics - **Evolution of Record Completeness:** Historical definitions of CVE completeness versus modern expectations, where security consumers demand metrics like CVSS severity scores, CWE weakness types, and software identification. - **Centralization vs. Federation:** Prior to 2016, MITRE authoring every CVE did not scale. Federation to CNAs has enabled broader coverage and timely reporting. - **The Enrichment Initiative & Tooling:** Launched in April 2024, the CVE Program's enrichment initiative urged CNAs to enrich their own records. This effort was significantly aided by community tooling like Vulnogram, which lowered barriers to adding structured enrichment. - **Enrichment Recognition List (ERL):** Introduced in September to acknowledge CNAs routinely providing CVSS and CWE data, tracked and published on a bi-weekly cadence to incentivize adoption. - **Third-Party Enrichment and Backlogs:** Historical reliance on third parties like NVD or current efforts like CISA's Authorized Data Publisher (ADP) / Vulnrichment, especially during lulls in downstream processing.

### Technical Details - **Historical Baseline:** In 1999, a CVE record required only an ID, description, and external reference (a format preserved on legacy servers for 1999 advisories). - **Enrichment Metadata:** Today's ecosystem depends on standards like CVSS, CWE, software identifiers (CPE, package URLs), EPSS, and KEV catalog entries for operational prioritization. - **Structured Format & CNA Authority:** Program format updates (developed with the Quality Working Group) allow CNAs—the authoritative source who understand their own products best—to embed CVSS, CWE, and CPE metadata at disclosure rather than waiting for third-party analysis. - **ERL Implementation:** Evaluates active CNAs within specific timeframes (e.g., checking data within a four-week window of their most recent record across a year), showing CNA participation rising into the 70% range.

### Takeaways & Discussion Summers emphasizes that enriching records at disclosure provides defenders with timely, accurate data and avoids downstream delays. During the Q&A, Summers addressed practical challenges: MITRE's CNA of Last Resort (CNA-LR) struggles to enrich records because researchers often lack developer-level insights; discrepancies raised by attendees regarding ERL inclusion counts and publishing timeframes; and the clarification that MITRE acts as secretariat and root rather than a centralized auditing body for CNA data quality. While third parties like CISA ADP and NVD provide secondary enrichment queues, CNAs remain the primary target for driving data completeness.