This blog post was authored by Lisandro Ubiedo (@_lubiedo) on
CVEs, or Common Vulnerabilities and Exposures, are IDs used to reference know vulnerabilities. These provide a description and public information provided by the parties involved in the disclosure of the vulnerability or exposure and are often used by researchers to act upon the disclosed information.
While working on collecting information about specific CVEs in a simple form we came up with an small piece of code that will make that work much simpler and fast. We use NIST’s NVD (National Vulnerability Database) feed to retrieve the updated CVE list and parse it depending on our search criteria which can be by year and what we are looking for. For example, we can search for Apache CVE entries from 2020 and only retrieve one in a short form:
$ python3 search.py -c 1 -s -y 2020 "apache"
ID: CVE-2020-10280
DATE: 2020-06-24T06:15Z
IMPACT:
Base Score: 7.5
Severity: HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
DESC: The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.
As you can see, the short form will print the information with the most important information retrieved from the NVD feed. This information is: ID, date for entry creation, impact of vulnerability or exposure (along with score, severity and vectors) and a short description. If no -s switch is provided then the output will be in pure JSON. All parameters and switches can be printed to screen by using -h/—help.
Code is here for free use: