CPE Metadata: Know IT ALL

### Overview In this presentation, an InfoSec engineer at MongoDB specializing in product security, bug bounty, and CVE disclosures explores the critical role of Common Platform Enumeration (CPE) metadata in vulnerability management. The speaker addresses the fallout from the National Vulnerability Database's (NVD) early 2024 slowdown in enriching Common Vulnerabilities and Exposures (CVEs) with metadata such as Common Vulnerability Scoring System (CVSS) scores and CPEs. To ensure vulnerability scanners and automated tools function reliably, the speaker argues that CVE Numbering Authorities (CNAs) must proactively self-enrich their CVE publications by including CPE metadata at the source.

### Key Topics - **CVE and Metadata Basics**: The speaker structures CVE data around the "who, what, where, and how" framework: CVE is the vulnerability (who), CVSS score reflects severity (what), CPE pinpoints the affected product and version (where), and CWE outlines the underlying flaw (how). - **The NVD Enrichment Slowdown**: Historically, industry vulnerability scanners have heavily relied on NVD analysts to populate CVSS and CPE metadata into the NVD CPE dictionary. In early 2024, NVD announced a slowdown in enriching CVEs, creating risks of delayed metadata, vulnerability miscategorization, and unprotected systems. - **The Gap in CPE Inclusion**: While CNAs publish CVEs via the CVE program's JSON schema, they are not mandated to provide metadata. Historically, over 50% of CVEs contain CVSS and CWE, but only 13.3% of all issued CVEs have ever included CPEs. While CPE inclusion in CVE JSON files hovered at or below 10% historically, it surged to 26% in 2023 and 54% in 2024, partially prompted by NVD's slowdown. - **CNA Demographics and Adoption**: CVE issuance has grown rapidly, jumping 38% in 2024 after an earlier doubling in 2017. CNA membership reached 447 organizations by 2025. While 288 CNAs (64%) have issued CVEs containing CPEs, manual labor constraints and third-party CVE assignments cause substantial inconsistency across published records.

### Technical Details - **JSON Schema Structure**: The CVE JSON format accommodates metadata directly within dedicated blocks. CNAs populate the `cna` container, which features an `affected` section containing a `cpes` array. Authorized Data Publishers (ADPs), such as CISA, populate a separate `adp` container. - **CPE 2.3 Format Breakdown**: The speaker illustrates a CPE string using MongoDB's Rust driver: - Prefix: `cpe:2.3` denotes the CPE specification version. - Part: `a` specifies application (contrasting with `o` for operating system or `h` for hardware). - Vendor: `mongodb` denotes the vendor name. - Product: `rust_driver` identifies the specific software. - Version: `0.10.0` isolates the affected version for vulnerability identification and patch assessment. - Optional Fields and Wildcards: Subsequent fields (update, edition, language, etc.) use wildcards (`*`) as placeholders, with MongoDB server noted as the target software. - **Operational Workflow at MongoDB**: MongoDB manages an internal CPE database in a spreadsheet mapped to product releases. When issuing a CVE, the team first searches the NVD CPE dictionary to maintain naming consistency, generating new CPE identifiers for novel products and embedding them directly into the CVE JSON file before publication.

### Takeaways - **Self-Enrichment Benefits CNAs**: By supplying accurate CPEs and CVSS scores at disclosure, vendors maintain narrative control over their vulnerabilities, eliminate discrepancies between vendor bulletins and third-party databases, and minimize customer confusion. - **Automation and Scanner Reliability**: Vulnerability scanners depend on standardized product identifiers to pinpoint affected systems. Direct CNA enrichment guarantees scanners can accurately detect vulnerable assets even when central bodies like NVD or CISA experience backlogs. - **Call to Action**: CNAs are urged to overcome the manual friction of initial setup by systematically integrating CPE metadata into their CVE release workflows, driving enablement and resilience across the vulnerability management ecosystem.