Wiz Authorized to Assign CVE Numbers as Cloud Vulnerability Disclosure Expands

Summary

Wiz says it is now authorized to assign CVE numbers. The company supports broader disclosure of cloud-service vulnerabilities, including issues that may not require customer action, and cites recent CVE Program and Microsoft policy changes.

Key points

Wiz has been authorized by the CVE Program to assign CVE identifiers to vulnerabilities and share disclosures.
The article says CVE Program rule changes allow CNAs to assign CVEs to significant vulnerabilities even when customers do not need to take action.
Microsoft announced it will issue CVEs for critical cloud-service vulnerabilities, including cases where customers need not install a patch or take other protective action.
Wiz urges cloud service providers to make CVE-based disclosure of cloud vulnerabilities an industry norm.
Wiz cites its 2021 discovery of ChaosDB in Azure Cosmos DB: exposed access keys could grant access to other customers’ databases, and affected users needed to rotate keys manually. The article says the exposure timeframe was unclear.

Article Details

Event Type: Wiz was authorized by the CVE Program as a CVE Numbering Authority (CNA), allowing it to assign CVE identifiers to vulnerabilities and share disclosed vulnerability information.
Impact: The authorization supports more standardized and transparent disclosure of cloud vulnerabilities. The article says cloud vulnerabilities can require remediation by both providers and customers, and argues that CVE assignments can clarify risks and response responsibilities.

Vendors

MicrosoftSecurity Cyber Safety Review Board (CSRB) highlighted this issue in their review of the Summer 2023 Microsoft Exchange Online intrusion, recommending that cloud service providers work with the CVE Program to WizWiz has been authorized by the Common Vulnerability and Exposures (CVE®) Program as a CVE Numbering Authority (CNA). This milestone is thrilling and humbling. Not only are we excited to deepen our support for the global

Products

Azure Cosmos DBof this dynamic: in August 2021, we discovered an unprecedented service-level vulnerability in Azure Cosmos DB. Customers’ access keys were leaked, with access permissions to Cosmos DB databases of other cloud

Industries

Cybersecuritysecurity community by being able to assign CVEs to vulnerabilities – and rapidly share disclosed cybersecurity vulnerabilities with the public – but it also prompts us to reflect on how far things have come in the