NVD NIST Enrichment Data

[rxerium]

Hey team,

I was made aware by @olearycrew yesterday that NVD NIST have paused on providing enrichment data for vulnerabilities on their site and after further investigating, to me, this could be quite alarming if paused for an extended period of time. I'm seeking clarification on how this situation might impact the Nuclei Template repository specifically. Do we anticipate a slowdown in the creation of templates?

Articles:

• https://www.scmagazine.com/news/update-delays-to-nist-vulnerability-database-alarms-researchers
• https://www.linkedin.com/pulse/security-industry-depends-nvd-patrick-garrity--jwq9c/

Many thanks,

Rishi

[ehsandeep]

@rxerium it might impact automated enrichment of CVE templates to include information like classification, but it shouldn't impact the creation of templates, since template creation is based on PoC available on the internet, for templates CVE data from NVD primarily used for enrichment only.

[rxerium]

Thanks @ehsandeep! CWE and CPE data is lacking which could affect the creation of PoCs. Reduced PoCs = fewer Nuclei templates? Do correct me if I'm wrong