GB/T 28458-2020Information security technology—Cybersecurity vulnerability identification and description specification (English PDF)

3.1 Cybersecurity Vulnerability

Cybersecurity vulnerability refers to a defect or weak point that is unintentionally or intentionally generated during the process of demand analysis, design, implementation, configuration, testing, operation and maintenance of network products and services, and may be exploited. other than fixed fields, for example, an alternative name of the vulnerability. Example:

GNU Bash. high risk. remote code execution vulnerability. shell break vulnerability

5.3 Description Items

5.3.2 Release time

The date that the vulnerability information was released. Date writing shall adopt the extended format of complete representation in 5.2.1.1 of GB/T 7408-2005. The format is: YYYY-MM- DD, for example, 2019-01-01. Among them, YYYY signifies a calendar year; MM signifies the ordinal number of the calendar month in the calendar year; DD signifies the ordinal number of the calendar day in the calendar month.

5.3.3 Releaser

The abbreviation of "vulnerability releaser", which is an individual or organization that releases validated vulnerability information. The releaser is named after its personal identification or organization name. The "organization name" can be the official name or short name of the releaser's organization. If the vulnerability releaser is an individual, it may be named with the name of the organization, to which, it belongs. See the format below: Personal identification of vulnerability releaser (vulnerability releaser's organization name)

Multiple releasers are allowed, which are separated by commas, for example:

Zhang San (organization A), Li Si (organization A, organization B), Wang Wu, organization C The vulnerability release shall comply with the requirements specified in 5.5 Vulnerability Release in GB/T 30276-2020.

5.3.4 Validator

The abbreviation of "vulnerability validator", which is an individual or organization that technically validates the existence, level and category of vulnerabilities. The validator is named after its personal identification or organization name. The "organization name" can be the official name or short name of the validator's organization. If the vulnerability validator is an individual, it may be named with the name of the organization, to which, it belongs. See the format below: Personal identification of vulnerability validator (vulnerability validator's organization name)

Multiple validators are allowed, which are separated by commas, for example:

Zhang San (organization A), Li Si (organization A, organization B), Wang Wu, organization C The vulnerability validation shall comply with the requirements specified in 5.3 Vulnerability Validation in GB/T 30276-2020.

5.3.5 Finder

The abbreviation of "vulnerability finder", which is an individual or organization that finds the vulnerability. The finder is named after its personal identification or organization name. The "personal identification" can be the name or code of the individual finder; the "organization name" can be the official name or short name of the finder's organization. If the identity of the finder cannot be confirmed, or the vulnerability information was anonymously released, the finder can be identified as "anonymous". If the vulnerability finder is an individual, it may be named with the name of the organization, to which, it belongs. See the format below: Personal identification of vulnerability finder (vulnerability finder's organization name)

Multiple finders are allowed, which are separated by commas, for example:

Zhang San (organization A), Li Si (organization A, organization B), Wang Wu, organization C The vulnerability finding shall comply with the requirements of 5.1 a) in GB/T 30276-2020.

5.3.6 Category

The category, to which, the vulnerability belongs. It provides information on the attribution of vulnerability classification. The classification of categories shall comply with the requirements specified in Chapter 5 Cybersecurity Vulnerability Classification of GB/T 30279-2020.

5.3.7 Level

The vulnerability hazard level, which provides the extent of hazard that the vulnerability may cause. The classification shall comply with the requirements specified in 6.3.3 Technical Classification of Cybersecurity Vulnerabilities in GB/T 30279-2020.

5.3.8 Affected product or service

Details of the product or service, in which, the vulnerability exists. It includes supplier, name and version No., etc. For vulnerabilities with shared middleware or components, the related products or service information affected by them can all be listed.

5.3.9 Relevant number

The number of the same vulnerability in different organizations, for example, CNVD number, CNNVD number, CVE number or vulnerability number customized by other organizations, etc.

If there are multiple numbers, they can be provided in sequence and separated by commas. See Appendix A for the XML representation method of relevant number.

5.3.10 Existence statement

Describe the triggering conditions, generation mechanism or conceptual proof of the vulnerability.