Confusing Value with Enumeration: Studying the Use of CVEs in Academia
summary
Analysis of 1,803 CVEs claimed in 304 papers finds 34% unconfirmed or disputed, 274 reserved, 288 with no maintainer response, and 52 where maintainers say it’s not a security bug; CNAs of last resort issue about twice as many IDs as regular CNAs and often don’t verify reports. A survey of 103 academics shows 71% try to obtain CVEs and 76% think CVEs help acceptance, yet 54% wrongly believe CVEs are always independently verified.
AI-written summary · about
chapters (11)
- 0:00Study on CVE misuse
- 1:18What is a CVE?
- 2:42CVE as impact proxy
- 3:47Research goals and methods
- 4:31CVE usage in security papers
- 6:21CVE outcomes and responses
- 9:41CNA last-resort problems
- 11:27CVE assignment differences
- 14:44Academic CVE perceptions
- 16:57CVE verification myths
- 17:41Conclusions and recommendations
related talks
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
45mFuture of CVE
33mCVE Decaf: Brewing Better and More Actionable Data Quality
24mSecurity Advisories and Vulnerability Prioritization in the Wild
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?