Externally inferred CVEs

Cortex Cloud identifies externally inferred CVEs by comparing the product name and version of an active service, if identifiable, with CVEs for those products in the National Vulnerability Database (NVD). We categorize externally inferred CVE matches as high or medium confidence based on the version information that is available on the service and from NVD.

• High Confidence Match—Precise version information is available both from the service and from NVD. Cortex Cloud generates issues for high-confidence externally inferred CVEs.
• Medium Confidence Match—Part of the version information from the service matches the NVD entry for the CVE, but the version information from the service or from NVD has additional characters. Cortex Cloud creates findings for medium-confidence externally inferred CVEs but will not generate issues.

Note

An externally inferred CVE might impact your service or asset, but additional investigation is required to confirm that the CVE is actually present.

Examples of externally inferred CVE matches

Service information available from ASM scan	CVE information available from NVD	Match result	Details
Apache v 2.4.49	CVE-2021-41773Affects cpe:2.3🅰️apache:http_server:2.4.49:*:*:*:*:*:*:*	High Confidence Match	Because the CPE information from NVD matches the version of Apache indicated from the scan, this is a high confidence match.
Apache v 2.4.49c	CVE-2021-41773Affects cpe:2.3🅰️apache:http_server:2.4.49:*:*:*:*:*:*:*	Medium Confidence Match	Because the version numbers from the service and the NVD information match, except for the additional character in the version from the service, this is a medium confidence match.
Apache v 2.4.50	CVE-2021-41773Affects cpe:2.3🅰️apache:http_server:2.4.49:*:*:*:*:*:*:*	No Match	Because the CPE information from NVD indicates a version of Apache that is different than the one we saw in the scan, this does not match.
Apache v 2.4.50 (Running on Red Hat Enterprise Linux 6 (RHEL6), which is not affected by this CVE)	CVE-2022-22719Affects cpe:2.3🅰️apache:http_server:*:*:*:*:*:*:*:* (up to and including 2.4.52)	High Confidence Match	Because the CPE information from NVD matches the version of apache indicated from the scan, this is a high confidence match. Cortex Cloud cannot determine if mitigating controls are in place or the underlying OS, so this pairing will still generate a high confidence match.
Apache (any version number)	CVE-2012-3526Affects cpe:2.3🅰️apache:http_server:*:*:*:*:*:*:*:*	No match	Because this CVE does not indicate any specific version number, we do not consider it a match for any version of Apache http_server, regardless of version information.