Common Enumeration (CPE, CCE, and CVE)

What Enumeration Means

In order for a vulnerability scanner to be able to find vulnerabilities on your network, it needs to know what it's looking for, and it does that by downloading information from online, from the internet. But what is it downloading? Some of it is common enumerations.

The simple definition of enumeration just means we're establishing the number of something. When it comes to cyber security, we're defining what the different products out there are, what the different configurations out there are, and we're putting a number to it. We're defining exactly what we're looking for.

Vulnerability scans start out by understanding what the network looks like. They need to understand what hardware is on the network, what operating systems are running on there, what software is on there. It needs to know a number of things about your network to establish what the vulnerabilities are that can be found on that network.

Common enumeration just means that we're going to be identifying all of the hardware, operating systems and software that is known to us. Same thing with the known configurations that are out there and the known vulnerabilities that are out there. We're going to identify them and categorize them.

Common Platform Enumeration

The first one we'll take a look at is the common platform enumeration. The common platform enumeration identifies hardware, operating systems and software.

Let's take a look at an example. Let's say we have a server that's running on our network. That server is manufactured by some company, and in this case let's say it's manufactured by Dell, so we've got a Dell server. There are several Dell hardware components that are on that server, as well as — Dell doesn't manufacture all the components of it. They maybe have purchased some stuff from Intel, and maybe they got certain components from other companies, but we're just going to look at this from a high level. So let's just say Dell created this server.

There's also an operating system that's installed on it. Let's say it's Microsoft, so it's a Windows. We're going to use a Windows Server 2008 R2 as our example here, and so this is an oldie one that's on our network. Let's say the software that it's running maybe is Apache, and we have Apache running on this.

Now what we need to do is identify all these hardware components that are on here, the operating system, and then any software that's running on this machine. For each one of those components, we're going to have some sort of designator.

Reading a CPE Designator

Notice that the designator starts out with a CPE, so common platform enumeration. And then we designate what it is here that we're talking about. So for instance, this O stands for operating system. If it was H, it would be hardware. If it was A, it would be an application that's running on the server. So that identifies what it is that we're talking about here. Specifically, this operating system is Microsoft Windows Server 2008 R2, and so now we understand what operating system is running on it and we can label that — we're enumerating that.

Now, the CPE schema does change over time, but essentially some of the core components that you're going to find are that it's going to start out by labeling that it is CPE, that it's common platform enumeration; then the part, that's going to be that operating system O, or hardware H, or A for application; then the vendor, and in the case that we're looking at that was Microsoft; and the product, which was Server 2008, or actually the version is R2 right there. And any updates, additions, languages, any specific kind of versions of this, then it will label that.

So it has some sort of structure to how it labels it, so we can identify a specific software that's released. From there we can reference this with any kind of vulnerabilities or configurations that it might have.

The CPE Dictionary

I'm on the NIST website here looking at the official common platform enumeration, or CPE, dictionary. Essentially it's a database of all of the different operating systems and hardware and software that they're tracking. We could download this full dictionary. This is the official dictionary. It's as of 382025, so that's today, so it keeps it up to date here. I could click on this and download it, so we've got a copy and we're going to take a look at that. It also shows you kind of what the format is, so if you wanted to understand what the format looks like, you could take a look at that.

Let's look at a specific example here. We mentioned the Windows Server 2008, so we can see the labeling of this right here. It is an operating system, so it has the O. It's then the vendor, which is Microsoft in this case. Then what it is, which is Windows Server 2008 R2. And then it gives some version information and stuff. This is just a way to say that it's including all of the versions of this, but there are ways that we can track the specific versions of Windows Server 2008 R2 by filling in these different components here. This is one of the versions here — let's go ahead and copy that and we're going to take a look at that inside the dictionary.

Here's that dictionary file when we open it up. Each one of these is about eight lines or so, and each one of these is an object that it's tracking, or an item that it's tracking. Here, this is an application — we can see the A. So we see CPE sla, so this is an application, and specifically it's Kindle's book project here that it's tracking. And then it gives a few pieces of information about it.

If we scroll through there, there's over 11 million lines to this, so this is a pretty huge database, or pretty huge dictionary, of all these different software and operating systems.

What we're going to do is do a search for that Microsoft Windows Server 2008. I'll just click on that and click find, and there it is. So now we can find a specific item here. We see that this is that Server 2008 R2 with some information about that. It's also tracking other ones, like Microsoft Windows Server 2008 service pack one. It's also all the different versions here, so we can see a lot of just this Server 2008 — we can see a lot of variations of that as well. So you can see that this list of just all of these identifiers is pretty long.

Since my example said that we're going to take a look at the Dell server too, let's go ahead and just type in Dell in here. You can see that hardware could be found as well, so we've got some hardware components here. And this is actually an application there. So let's go through and see if we can find a Dell that's an application as well. Dell, of course, does have applications. I'm not finding a hardware on here, but they do exist as well. In fact, if we wanted to find hardware — so this is some sort of hardware that we found here. So you can see that we've got a lot of different things that we're tracking on it.

Common Configuration Enumeration

Now, as our vulnerability scanner identifies what it is that's on our network, that's a sign that maybe this is outdated and no longer supported, but it doesn't give us the full picture, because how is Windows Server 2008 R2 configured? And are there any active vulnerabilities on this version? That's where we're going to want to enumerate other things too, like the configuration and vulnerabilities.

For the configuration we have the common configuration enumeration, or the CCE. Once we've identified a certain application or software that's running on this — or, in this case, we're using an example of an operating system — then we know what configurations we're going to need to set up on it. And so we have the common configuration enumeration to do that.

Here I'm on the NIST website once again, looking at the common configuration enumeration, or CCE. We see how the identifiers look: it starts out with CC dash and then some sort of number there. We can actually see the list, so I'm going to click on the list and it's going to bring us to a list of some of the ones here. Since we're using that Server 2008 R2 as an example, let's find that on here. There's the Server 2008 R2, and we're going to download a copy of that and take a look at what that looks like.

Here's that Excel document opened up. We can see the different CCE IDs here on the left hand side. It starts out here at 12,07-1, and this is all specific to that Windows 2008 R2 server.

I'm going to take a look at password, and see what some of the password ones look like. This is a specific configuration: always prompt password upon connection. This is a setting on that machine, a 2008 R2 setting on that machine. So we can then take a look at what this setting should be set for, and understand what the parameters are — so this could be enabled or disabled — and understand how we find some of the information on that system.

Let's take a look at another one. I'm going to hit find next, and here we have: choose the default folder recovery password. As you can see, there's how many lines are on this document. So for Server 2008 R2, we have over a thousand different configurations that are specified by this document.

So now, as we're doing the vulnerability scans, we can identify by this CPE the specific operating system that this server is running. Not only that, but we know all the configuration settings and we can address a specific configuration of that operating system.

Common Vulnerabilities and Exposures

But another thing we need to understand — or at least our scanner needs to understand — is what the common vulnerabilities and exposures are as they relate to this operating system. So once your scanner identifies the operating system, it can also understand what the vulnerabilities and exposures of that specific operating system are, things that it needs to look out for.

I'm back at the NIST website looking at the page we've already looked at. This is the one that specifies the CPE of the Windows Server 2008 R2. The reason why I brought us back to here is because what's associated with this is several vulnerabilities. At the bottom here we see view vulnerabilities. I click on view vulnerabilities and we are routed then to this vulnerability database here that lists out all of the vulnerabilities of Windows Server 2008 R2.

As we scroll through here, we can see that there's a long list on this page, and it goes for pages and pages. We've got, looks like, at least over 10 pages there, or at least 10 pages of information here of different vulnerabilities that are out there.

This one was published in 2024. This is a CVE, a common vulnerability and exposure. It starts out with CVE and then has a dash, and then it says 2024, and that's because this vulnerability was discovered and logged in 2024. In fact, in 2024, it was the 38,149th vulnerability that was discovered that year.

What we could do is look at this. This one is a BranchCache denial of service vulnerability. I could click on it to find out more information on this specific vulnerability. When I see this vulnerability here, here's all the details of it, and down below is what this is associated with. So it's associated with Windows 10, Windows 11, Windows Server 2008, Windows Server 2012, Windows Server 2019, 2020, 2022 — so quite a few different servers that this vulnerability affects.

So now our vulnerability scanning is identifying specific hardware, specific operating systems, specific software; identifying different configurations of those hardware, operating system and software; and also identifying the vulnerabilities associated with those.

Scoring Systems

It also wants to take a look at scoring: what is the danger in both the configurations and also the vulnerabilities, and how does it rate? Is it just something that's minor, or is it something significant, or is it a critical issue that needs to be fixed right away?

The CVSS, or common vulnerability scoring system, is a way that we can score the system on a scale from 0 to 10 to identify: is it of low concern, a moderate concern or high concern, something that we need to tackle right away? And to understand how critical this vulnerability is.

Back on that site that we were seeing before, talking about that specific CVE, we can see what the score is here. This one in particular is a 7.5 high. In fact, if I go back a level here, back to our Windows Server 2008 R2 vulnerabilities that we see here, it gives a label: 7.5, 7.5, 8.8, 7.8, 7.8. And here's a 6.5 medium one. So we can understand how critical these different vulnerabilities are and how quickly we should be addressing these vulnerabilities.

But we don't want to do that just for our vulnerabilities, that we have the CVSS score for. We also want to do that for our configurations, and that's where we have the CCSS. The CCSS is a very similar scoring system — in fact, it's modeled after the CVSS, so it's very similar, except that in this case it's a scoring system for configurations. That's the one difference here. So now we can score both vulnerabilities and also configurations.