NIST National Vulnerabilities Database

National Institute of Standards and Technology

This connector provides a way of accessing CVE and CPE information. All information is gathered from the National Vulnerability Database

Capabilities

CVE - Common Vulnerabilities and Exposures

It's possible to get CVEs by:

ID: Single

Modification Date Range: Gets all CVEs modified in the selected date range

Published Date Range: Gets all CVEs published in the selected date range

Keyword: Gets all CVEs looking for a keyword in the vulnerability description

CWE ID: Gets all CVEs containing a CWE

Severity: Gets all CVEs classified based on the severity

CPE - Common Platform Enumeration

It's possible to get CPEs by:

Modification Date range: Gets all CPEs modified in the selected date range

Keyword: Gets all CPEs looking for a keyword in the vulnerability description

CPE String Search: Gets all CPEs containing a mention to a product

About API Parameters

For parameters which does not require a value, a empty string must be provided.

These parameters are:

hasCertAlerts

hasCertNotes

hasKev

hasOval

isVulnerable

noRejected

Notes

The public rate limit (without an API key) is 5 requests in a rolling 30 second window; the rate limit with an API key is 50 requests in a rolling 30 second window

To Request an API Key

On the API key requests page, enter data into the three fields on the requests form.

Scroll to the bottom of the Terms of Use, and then click the check box marked I agree to the Terms of Use.

Check the inbox of the email address provided in the steps above for an email from [email protected].

Activate and view the API Key by opening the single-use hyperlink. Store the API Key in a secure location as the page will no longer be available after it is closed. If your key is not activated within seven days, the single-use hyperlink will expire.

Each API Key is associated with a single email address. If an email address is used to request an additional API key, clicking the single-use hyperlink will invalidate the key previously associated with that email address. The key will not be invalidated if the email address is used to request another key, but the hyperlink is not opened. There is no process for retrieving a forgotten key or confirming whether a key has been requested or activated by any email address.

Click here to know more!

NIST API Doc

Configurations

NIST API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
api_key	NIST API key	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get CPEs

Retrieve information on a single CPE record or a collection of CPE records from the Official CPE Dictionary

Endpoint

URL: https://services.nvd.nist.gov/rest/json/cpes/2.0/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.resultsPerPage	number	Optional	Parameters for the Get CPEs action
parameters.cpeNameId	string	Optional	Parameters for the Get CPEs action
parameters.cpeMatchString	string	Optional	Parameters for the Get CPEs action
parameters.keywordExactMatch	string	Optional	Parameters for the Get CPEs action
parameters.keywordSearch	string	Optional	Parameters for the Get CPEs action
parameters.lastModStartDate	string	Optional	Parameters for the Get CPEs action
parameters.lastModEndDate	string	Optional	Parameters for the Get CPEs action
parameters.matchCriteriaId	string	Optional	Parameters for the Get CPEs action
parameters.startIndex	number	Optional	Parameters for the Get CPEs action

Input Example

{"parameters":{"resultsPerPage":1,"cpeNameId":"87316812-5F2C-4286-94FE-CC98B9EAEF53","cpeMatchString":"cpe:2.3:o:microsoft:windows_10","keywordExactMatch":"Microsoft","keywordSearch":"Red Hat","lastModStartDate":"2021-08-04T13:00:00.000%2B01:00","lastModEndDate":"2021-10-22T13:36:00.000%2B01:00","matchCriteriaId":"36FBCF0F-8CEE-474C-8A04-5075AF53FAF4","startIndex":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
resultsPerPage	number	Result of the operation
startIndex	number	Output field: startIndex
totalResults	number	Result of the operation
format	string	Output field: format
version	string	Output field: version
timestamp	string	Output field: timestamp
products	array	Output field: products
products.cpe	object	Output field: products.cpe
products.cpe.deprecated	boolean	Output field: products.cpe.deprecated
products.cpe.cpeName	string	Name of the resource
products.cpe.cpeNameId	string	Unique identifier
products.cpe.lastModified	string	Output field: products.cpe.lastModified
products.cpe.created	string	Output field: products.cpe.created
products.cpe.titles	array	Output field: products.cpe.titles
products.cpe.titles.title	string	Output field: products.cpe.titles.title
products.cpe.titles.lang	string	Output field: products.cpe.titles.lang

Output Example

{"status_code":200,"response_headers":{"content-type":"application/json","content-encoding":"gzip","vary":"Accept-Encoding","x-frame-options":"SAMEORIGIN","access-control-allow-origin":"*","access-control-allow-headers":"accept, apiKey, content-type, origin, x-requested-with","access-control-allow-methods":"GET, HEAD, OPTIONS","access-control-allow-credentials":"false","date":"Thu, 19 Jan 2023 20:03:51 GMT","content-length":"478","apikey":"No","strict-transport-security":"max-age=31536000"},"rea...

Get CVEs

Retrieve information on a single CVE or a collection of CVE

Endpoint

URL: https://services.nvd.nist.gov/rest/json/cves/2.0/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.resultsPerPage	number	Optional	Parameters for the Get CVEs action
parameters.cpeName	string	Optional	Parameters for the Get CVEs action
parameters.cveId	string	Optional	Parameters for the Get CVEs action
parameters.cvssV2Metrics	string	Optional	Parameters for the Get CVEs action
parameters.cvssV2Severity	string	Optional	Parameters for the Get CVEs action
parameters.cvssV3Metrics	string	Optional	Parameters for the Get CVEs action
parameters.cvssV3Severity	string	Optional	Parameters for the Get CVEs action
parameters.cweId	string	Optional	Parameters for the Get CVEs action
parameters.keywordSearch	string	Optional	Parameters for the Get CVEs action
parameters.keywordExactMatch	string	Optional	Parameters for the Get CVEs action
parameters.lastModStartDate	string	Optional	Parameters for the Get CVEs action
parameters.lastModEndDate	string	Optional	Parameters for the Get CVEs action
parameters.pubStartDate	string	Optional	Parameters for the Get CVEs action
parameters.pubEndDate	string	Optional	Parameters for the Get CVEs action
parameters.startIndex	number	Optional	Parameters for the Get CVEs action
parameters.sourceIdentifier	string	Optional	Parameters for the Get CVEs action
parameters.versionEnd	string	Optional	Parameters for the Get CVEs action
parameters.versionEndType	string	Optional	Parameters for the Get CVEs action
parameters.versionStart	string	Optional	Parameters for the Get CVEs action
parameters.versionStartType	string	Optional	Parameters for the Get CVEs action
parameters.virtualMatchString	string	Optional	Parameters for the Get CVEs action
parameters.hasCertAlerts	string	Optional	Parameters for the Get CVEs action
parameters.hasCertNotes	string	Optional	Parameters for the Get CVEs action
parameters.hasKev	string	Optional	Parameters for the Get CVEs action
parameters.hasOval	string	Optional	Parameters for the Get CVEs action

Input Example

{"parameters":{"resultsPerPage":1,"cpeName":"cpe:2.3:o:microsoft:windows_10:1607","cveId":"CVE-2019-1010218","cvssV2Metrics":"AV:N/AC:H/Au:N/C:C/I:C/A:C","cvssV2Severity":"LOW","cvssV3Metrics":"AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","cvssV3Severity":"LOW","cweId":"CWE-287","keywordSearch":"Microsoft Outlook&keywordExactMatch","keywordExactMatch":"Microsoft Outlook&keywordExactMatch","lastModStartDate":"2021-08-04T13:00:00.000%2B01:00","lastModEndDate":"2021-10-22T13:36:00.000%2B01:00","pubStartDate":"2021-08-04T00:00:00.000","pubEndDate":"2021-10-22T00:00:00.000","startIndex":0,"sourceIdentifier":"[email protected]","versionEnd":"2.7","versionEndType":"excluding","versionStart":"2.2","versionStartType":"including","virtualMatchString":"cpe:2.3:*:*:*:*:*:*:de","hasCertAlerts":"","hasCertNotes":"","hasKev":"","hasOval":"","isVulnerable":"","noRejected":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
resultsPerPage	number	Result of the operation
startIndex	number	Output field: startIndex
totalResults	number	Result of the operation
format	string	Output field: format
version	string	Output field: version
timestamp	string	Output field: timestamp
vulnerabilities	array	Output field: vulnerabilities
vulnerabilities.cve	object	Output field: vulnerabilities.cve
vulnerabilities.cve.id	string	Unique identifier
vulnerabilities.cve.sourceIdentifier	string	Unique identifier
vulnerabilities.cve.published	string	Output field: vulnerabilities.cve.published
vulnerabilities.cve.lastModified	string	Output field: vulnerabilities.cve.lastModified
vulnerabilities.cve.vulnStatus	string	Status value
vulnerabilities.cve.descriptions	array	Output field: vulnerabilities.cve.descriptions
vulnerabilities.cve.descriptions.lang	string	Output field: vulnerabilities.cve.descriptions.lang
vulnerabilities.cve.descriptions.value	string	Value for the parameter
vulnerabilities.cve.metrics	object	Output field: vulnerabilities.cve.metrics
vulnerabilities.cve.metrics.cvssMetricV2	array	Output field: vulnerabilities.cve.metrics.cvssMetricV2
vulnerabilities.cve.metrics.cvssMetricV2.source	string	Output field: vulnerabilities.cve.metrics.cvssMetricV2.source
vulnerabilities.cve.metrics.cvssMetricV2.type	string	Type of the resource
vulnerabilities.cve.metrics.cvssMetricV2.cvssData	object	Response data
vulnerabilities.cve.metrics.cvssMetricV2.baseSeverity	string	Output field: vulnerabilities.cve.metrics.cvssMetricV2.baseSeverity
vulnerabilities.cve.metrics.cvssMetricV2.exploitabilityScore	number	Score value

Output Example

{"status_code":200,"response_headers":{"content-type":"application/json","content-encoding":"gzip","vary":"Accept-Encoding","x-frame-options":"SAMEORIGIN","access-control-allow-origin":"*","access-control-allow-headers":"accept, apiKey, content-type, origin, x-requested-with","access-control-allow-methods":"GET, HEAD, OPTIONS","access-control-allow-credentials":"false","date":"Thu, 19 Jan 2023 18:36:01 GMT","content-length":"1422","apikey":"No","strict-transport-security":"max-age=31536000"},"re...

Response Headers

Header	Description	Example
access-control-allow-credentials	HTTP response header: access-control-allow-credentials	false
access-control-allow-headers	HTTP response header: access-control-allow-headers	accept, apiKey, content-type, origin, x-requested-with
access-control-allow-methods	HTTP response header: access-control-allow-methods	GET, HEAD, OPTIONS
access-control-allow-origin	HTTP response header: access-control-allow-origin	*
apikey	HTTP response header: apikey	No
content-encoding	HTTP response header: content-encoding	gzip
content-length	The length of the response body in bytes	478
content-type	The media type of the resource	application/json
date	The date and time at which the message was originated	Thu, 19 Jan 2023 18:36:01 GMT
strict-transport-security	HTTP response header: strict-transport-security	max-age=31536000
vary	HTTP response header: vary	Accept-Encoding
x-frame-options	HTTP response header: x-frame-options	SAMEORIGIN