What is CPE? Common Platform Enumeration, the product names behind CVE matching

Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software and packages, maintained by NIST through its official CPE Dictionary. The National Vulnerability Database uses CPE names to state which products and versions a CVE affects, which is what lets a patch team match a published flaw to the software in its own inventory.

Who owns it

MITRE transferred all intellectual property associated with CPE to NIST, which holds operational responsibility for it and hosts both the dictionary and the specifications. The current naming specification, version 2.3, is NIST Interagency Report 7695, published in August 2011.

The CPE Dictionary is updated nightly as names are added or changed, and NVD accepts contributions of new names. Organizations outside government may use it voluntarily, and it is not subject to copyright in the United States.

How a CPE name reads

A CPE 2.3 name is a colon-separated string. On the NVD record for CVE-2015-3306, the vulnerable application appears as cpe:2.3:a:proftpd:proftpd:1.3.5:*:*:*:*:*:*:*, which carries the vendor, the product and the version, with asterisks in the remaining fields. The same record lists Debian, Fedora, openSUSE and SUSE platform names in separate configurations.

NVD calls these lists applicability statements. A configuration can be basic, can require two products together (running on or with), or can be advanced. Match string ranges add start and end versions, so one statement covers a run of releases instead of listing each one.

What a patch desk does with it

CPE is where automated matching succeeds or fails. If an asset's software is recorded under a name or version that does not line up with the NVD configuration, the CVE does not attach to that asset, and nothing flags the miss. NVD asks users to report a missing CPE match string or name to its dictionary team.

So normalize inventory names to dictionary entries where tools allow, and check unusual products by hand when they appear in a KEV addition. Remember that the configuration data reflects what was considered vulnerable at the time of NVD enrichment, which can trail the CVE itself.

Where it appears on Daily CISO

Must-patch names the vendor and product for each KEV addition, the starting point for an inventory match. Exploit lag links each CVE to its NVD record, where the CPE configurations sit.

Related terms

Common Vulnerabilities and Exposures (CVE), software bill of materials (SBOM), Common Weakness Enumeration (CWE) and Common Vulnerability Scoring System (CVSS).