A Clarification on CVE Records with a DISPUTED Tag

By Shannon Sabens, CVE Board member and Outreach and Communications Working Group (OCWG) Co-Chair

Several years ago, it was clear to the CVE Board that we would need a specific process for the inevitable disputes that may arise around vulnerability reporting. Potential scenarios may be obvious to many, but a basic example would be when a finder reports a potential vulnerability to a vendor/maintainer that agrees a bug exists but disagrees that it’s a potential security hole.

CVE Record Dispute …

cybersecurity information security infosec vulnerability vulnerability management