zmanion / cve Goto Github PK

Microsoft assigned two quite-different vulnerabilities to CVE-2022-41049. CNA rules state:

7.2.1 CNAs MUST NOT assign the same CVE ID to more than one independently fixable vulnerability.

CVE IDs are meant to track vulnerabilities not fixes.

CC @wdormann

The descriptions for CVE-2022-41049 and CVE-2022-41091 are identical except for description text stating that each is not the other and the descriptions do not convey sufficient information to uniquely identify vulnerabilities.

CVE-2022-41049 description:

Windows Mark of the Web Security Feature Bypass Vulnerability. This CVE ID is unique from CVE-2022-41091.

CVE-2022-41091 description:

Windows Mark of the Web Security Feature Bypass Vulnerability. This CVE ID is unique from CVE-2022-41049.

These descriptions do seem to meet the minimum requirements in 8.2.3 (Vulnerability Type is provided):

8.2.3 MUST include one of the following:
a. Vulnerability Type
b. Root Cause
c. Impact

https://cve.mitre.org/cve/cna/CNA_Rules_v3.0.pdf

CC @wdormann