Summary

  • MITRE's 2002 progress report dates CVE's public launch to September 1999 with 321 entries. It describes the list as a logical bridge among existing security tools and databases, not a replacement for their research or repair work.
  • The MITRE authors' 1999 design paper argues that pairwise mapping among N separate vulnerability databases grows on the order of N². A shared index lets each database map to one set of names. It deliberately left severity, local configuration and tool effectiveness outside that index.

Everyone had a database; nobody had the same name

Before a scanner result could be compared with a vendor advisory, an analyst had to establish that two descriptions pointed to the same defect. Security products carried their own vulnerability databases and vocabulary. MITRE's 1999 paper described the operational cost plainly: tools were hard to compare, results were hard to correlate, and an advisory could be difficult to connect to the affected system. More detections did not solve a naming collision.

The proposed repair for that coordination problem was intentionally small. A CVE entry needed a unique name and enough description to distinguish one issue from another. Each tool could map its own record to that common name. Without a common index, every pair of databases might require its own translation; with one, each database had a single bridge to maintain. The paper summarized the mapping burden as roughly N² versus N. This was not a claim that the shared list could diagnose every host. It was a way to ask whether different people were even talking about the same bug.

The authors refused an attractive detour: building a universal taxonomy of vulnerability types. Their September 1999 paper called CVE a concordance or index and left categorization to the databases that used it. Security tools had different purposes and different views of risk. A simple common label could pass among them without forcing everyone to accept one vendor's schema, severity scale or product design.

The number did not contain the verdict

The format looked authoritative, but its original rules were narrower. In the 1999 paper, a CVE name was a prefix, year and number. The number did not state the order in which flaws were discovered, and it did not encode severity. An entry was a reference point, not a measurement of exploitability on a particular machine. The same paper listed what common naming did not answer: the severity of the issue, local configuration and security policy, and how well a given tool handled it.

Getting that simple label into the public list was not mechanical. The 1999 account describes a draft, an Editorial Board and candidate names. A candidate could receive a provisional CAN identifier before the Board accepted it. Members could reject a proposal as a duplicate, merge it with another, split it, revise its description or request more evidence. The board's decision was about how to count and distinguish reported problems in a common list. It was not a patch test in the user's production environment.

The 2002 progress report records the September 1999 unveiling: 321 entries and a public site. MITRE described CVE's role as a logical bridge rather than a rival database or security product. The plan was for advisories, tools and vendor update sites to cite the same identifier. A scanner might say a host was exposed; a vendor site might point to a fix; an operator still had to verify the installed version, apply the right update and test the service afterward. The identifier made those receipts joinable. It did not issue them.

A narrow ledger can make a large system legible

CVE's strength came from keeping the common layer thin. A label that identified an issue across products made comparison and automation possible, but it could not settle every disputed description or inventory every vulnerable installation. The Editorial Board had to decide when reports referred to one issue, two issues or a duplicate. Vendors had to map their own records to the accepted name. Operators had to connect that name to software actually running on their systems.

In September 1999, 321 public entries established a coordinate system for that work. The count was the size of the initial list, not a census of all security defects and not an inventory of repairs. CVE did not make the crack in the machine disappear. It gave the people holding three different diagrams a shared way to point at it. The screwdriver remained on another bench.