What is a CPE name?
Common Platform Enumeration: a structured name for a product and version, used to match CVEs to the software you run.
A CPE 2.3 name has the form cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other, where part is a (application), o (operating system) or h (hardware). NVD lists which CPEs, or version ranges of them, each CVE affects.
Matching breaks when the vendor or product name in your inventory differs from the dictionary spelling, a common source of missed or false findings in scanners.
Example:
cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:* names Apache Log4j 2.14.1, one of the versions affected by CVE-2021-44228.Sources
Related terms
- NVDThe National Vulnerability Database run by NIST, which republishes CVE records and adds analysis such as CVSS scores, CWE types and CPE product names.
- CVECommon Vulnerabilities and Exposures: the public ID system for disclosed security flaws, written as CVE-YEAR-NUMBER, for example CVE-2021-44228.