CVE Intelligence Gathering

CVE Intelligence Gathering

Systematically collects CVE vulnerability details from multiple authoritative sources, handles search failures, and compiles a comprehensive vulnerability profile for analysis.

When to Use This Skill

Use this skill when:

• Starting CVE analysis and need complete vulnerability information
• Web searches are returning limited or no results
• CVE is very new and not yet in all databases
• Need to distinguish between authoritative and user-provided information
• Building evidence for security compliance reports

Prerequisites

Required

• Valid CVE identifier (format: CVE-YYYY-NNNNN)
• Internet connectivity (recommended but not required)
• web_search tool access

Optional

• User-provided CVE details (fallback when internet unavailable)
• Links to security advisories

Implementation Steps

Step 1: Validate CVE Format

# Regex pattern for CVE ID
CVE_PATTERN="^CVE-[0-9]{4}-[0-9]{4,}$"

# Validate format
if [[ "$CVE_ID" =~ $CVE_PATTERN ]]; then
  echo "Valid CVE format"
else
  echo "ERROR: Invalid CVE format. Expected: CVE-YYYY-NNNNN"
  exit 1
fi

Extract components:

• Year: YYYY from CVE-YYYY-NNNNN
• Number: NNNNN from CVE-YYYY-NNNNN

Decision Point:

• IF invalid format → Return error to parent command
• IF valid → Continue to Step 2

Step 2: Search Primary Sources (NVD and MITRE)

National Vulnerability Database (NVD)

Search query: "CVE-{ID} site:nvd.nist.gov"
Example: "CVE-YYYY-NNNNN site:nvd.nist.gov"

Extract from results:

• CVSS Score (v3.1, v3.0, or v2.0)
• Severity rating (CRITICAL/HIGH/MEDIUM/LOW)
• Base score and vector string
• Affected product/versions
• CWE (Common Weakness Enumeration) ID
• Published date and last modified date

MITRE CVE Database

Search query: "CVE-{ID} site:cve.mitre.org"
Example: "CVE-YYYY-NNNNN site:cve.mitre.org"

Extract from results:

• CVE description (official)
• References (links to advisories, patches, exploits)
• CWE classification
• Assigning CNA (CVE Numbering Authority)