CPE
Common Platform Enumeration
Standardisierte Produkt-/Versionskennung
CPE is a standardised naming scheme for IT products, operating systems and hardware. A CPE string uniquely identifies vendor, product and version, allowing vulnerabilities (CVE) to be matched to affected products by machine. CPE is thus the glue between an abstract vulnerability and the concrete asset in one's own estate.
History & facts. CPE originated at MITRE and is today maintained by the United States of America (US) National Institute of Standards and Technology (USA) (NIST) within the National Vulnerability Database (NVD) and the SCAP standard set. The current CPE 2.3 format follows the pattern „cpe:2.3:part:vendor:product:version:…“, where „part“ distinguishes application, operating system and hardware. An official CPE dictionary harmonises names so that different sources denote the same product identically.
Outlook & recommendation. The biggest practical weakness is matching quality: if the CPE in a Common Vulnerabilities and Exposures (CVE) does not exactly match the version actually deployed, false hits arise or, worse, real exposure is missed. More modern sources such as Open Source Vulnerabilities (OSV) or the European Union Vulnerability Database (EUVD) increasingly use package coordinates rather than CPE for software dependencies. For defensible vulnerability management, what counts is therefore less the CPE alone than its clean linkage to a maintained asset inventory.