CSA云安全联盟：2024年漏洞数据关键问题研究报告（英文版）.pdf

TopConcernswith

VulnerabilityData

ThepermanentandofficiallocationfortheVulnerabilityDataWorkingGroupis

/research/working-groups/vulnerability-data

©2024CloudSecurityAlliance–AllRightsReserved.Youmaydownload,store,displayonyour

computer,view,print,andlinktotheCloudSecurityAllianceatsubjectto

thefollowing:(a)thedraftmaybeusedsolelyforyourpersonal,informational,noncommercialuse;(b)

thedraftmaynotbemodifiedoralteredinanyway;(c)thedraftmaynotberedistributed;and(d)the

trademark,copyrightorothernoticesmaynotberemoved.Youmayquoteportionsofthedraftas

permittedbytheFairUseprovisionsoftheUnitedStatesCopyrightAct,providedthatyouattributethe

portionstotheCloudSecurityAlliance.

©Copyright2024,CloudSecurityAlliance.Allrightsreserved.2

Acknowledgments

LeadAuthors

AbhineethPasam

AhaanSinha

Reviewers

AlanCurranMSc

AnitaWhitby

CharanAkiri

CliftonFernandes

DebrupGhosh

EdwardNewman

GeneSchank

JamesMorgan-Jones

MallikaGunturu

MarkSzalkiewicz

MeghanaParwate

MichaelRoza

PrateekMittal

RahulKalva

RajashekarYasani

RhitvikSinha

ShrutiDhumak

SudheerVallandas

VaniMurthy

CSAGlobalStaff

JoshBuker

StephenLumpe

KurtSeifried

©Copyright2024,CloudSecurityAlliance.Allrightsreserved.3

TableofContents

Acknowledgments3

TableofContents4

Introduction5

RoleofVulnerabilityData5

CurrentStateofVulnerabilityData6

IdentifyingtheCurrentChallenges6

CVE6

DataQualityandFidelity6

PerverseIncentivestonotCreateCVEs7

FindingRelevantVulnerabilityData7

NotifyingProjectMaintainers8

LackofInteroperability8

ResolvingDisputes9

ComplexityofReportingVulnerabilities9

IncreasingNumb