Describing vulnerabilities in online services

[adulau]

A tag is used in CVE record format to describe Exclusively Hosted Service with the following definition:

All known software and/or hardware affected by this CVE Record is known to exist only in the affected hosted service. If the vulnerability affects both hosted and on-prem software and/or hardware, then the tag should not be used.

This could be an approach to specify this “tag”:

CVE records tags and recommended taxonomies in GCVE

Following the last working-group meeting with the MISP core team, many questions were raised concerning the tags and taxonomies used in the vulnerability ecosystem, including the CVE Program, GCVE, and others. The CVE Program defines some tags that can be included in the CVE record format. These appear to be documented at the following location: This documentation already includes some states that are indeed used by certain GCVE GNAs, for example in this online service vulnerability: The MI…