A vulnerability scanner's report tags each finding with an identifier in the CVE-year-number format. A new analyst asks what that identifier provides. What is the best answer?
Select an answer to reveal the explanation.
Short Explanation
Think of a CVE like a library catalog number: it doesn't tell you whether the book is good, it just makes sure everybody's talking about the same book. Your scanner, the vendor advisory and the threat feed can all point at one flaw by that ID. The trap is expecting the ID to tell you severity -- that's CVSS's job.
Full Explanation
Common Vulnerabilities and Exposures is a publicly maintained list in which each entry has a unique identifier for one specific, publicly disclosed vulnerability. The identifier lets scanners, vendor advisories, threat intelligence feeds, patch notes and ticketing systems refer unambiguously to the same flaw, which is what makes correlation across tools possible. A severity rating from 0 to 10 describes the Common Vulnerability Scoring System, a separate scoring method that is often published alongside a CVE entry but is not the identifier itself. A vendor patch package is the remediation produced by the software maker; an advisory may list the CVE it fixes, but the CVE does not reference or deliver a patch. A category of weakness describing a general coding mistake shared by many flaws is a weakness taxonomy, not an entry for one specific vulnerability. Exam caveat: the year in the identifier reflects when the ID was assigned or reserved, and the number carries no meaning about danger or priority. Operational check: when a scanner reports a finding, look up its CVE entry, note the associated CVSS score and vendor advisory, and confirm that the affected product version matches what is actually installed.