> For the complete documentation index, see [llms.txt](https://martian1337.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://martian1337.gitbook.io/notes/notes/security-research/publishing-cves.md).

# Publishing CVEs

This will guide you through the process of identifying, disclosing, and publishing a CVE responsibly.

> Note: The CVE Program moved its public record and tooling from `cve.mitre.org` to [cve.org](https://www.cve.org/) (2023-2024). CVE IDs are assigned by CVE Numbering Authorities (CNAs); MITRE acts as the CNA of Last Resort when no other CNA covers a product.

1. **Identify a New Vulnerability**: Research and ensure that the vulnerability you have discovered has not already been reported. Check whether it already appears in the [CVE List on cve.org](https://www.cve.org/) or other databases such as [Exploit-DB](https://www.exploit-db.com/).
2. **Responsible Disclosure to Vendor**: Contact the product's vendor or owner to report the vulnerability discreetly. Document all communication attempts as proof that you tried multiple times to contact the vendor to remediate the finding before going public with your research.
3. **Work with Cooperative Vendors**: If the vendor is responsive, collaborate on a mitigation strategy and agree on a coordinated disclosure timeline.
4. **Handling Non-Responsive Vendors**: If there is no response, consider waiting for a period (30 to 90 days) before public disclosure. Meanwhile, request a CVE ID from the appropriate CNA (many vendors are their own CNA; otherwise use MITRE as the CNA of Last Resort).
5. **Request a CVE ID**: Submit the vulnerability details through the vendor's CNA if one exists, or to MITRE via the [CVE Request form](https://cveform.mitre.org/). The CVE record will initially be in a 'RESERVED' state.
6. **Publishing the CVE**: Once you have waited the agreed-upon time and have the CVE ID, publish your findings on platforms like Packet Storm Security or your own advisory. Include the CVE ID in your publication.
7. **Notify the CNA of Publication**: After publishing, provide the publication links so the CVE record can move from 'RESERVED' to 'PUBLISHED'.

Additional References

**Trustwave's Guide**: "A Simple Guide to Getting CVEs Published" offers a comprehensive step-by-step process. [Trustwave Guide](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/a-simple-guide-to-getting-cves-published/)

<https://infosecwriteups.com/how-to-register-and-publish-a-cve-for-your-awesome-vulnerability-e68a6a5f748f>

### References

* [CVE Program (cve.org)](https://www.cve.org/)
* [CVE: Report or Request a CVE ID](https://www.cve.org/ResourcesSupport/ReportRequest)
* [CVE Numbering Authorities (CNAs)](https://www.cve.org/ProgramOrganization/CNAs)
* [CVE Record Submission form (cveform.mitre.org)](https://cveform.mitre.org/)