Subject: [sacm] CVEs with a Configuration Component

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 5 Dec 2016 19:10:01 +0000

During the SACM session at the IETF 97 Meeting, there was some discussion around finding out more information about CVEs that had a configuration component to them. Out of this discussion, I volunteered to find out if the CVE team maintained this information in hopes of learning:

(1) what percentage of vulnerabilities have a configuration component
(2) what are the most commonly referenced configuration settings in these vulnerabilities

Unfortunately, after talking with the CVE team, it turns out that they do not maintain this information. As a result, if we want to find examples of vulnerabilities with configuration components, we will have to track them down manually.

Thanks,

Danny