Section affected: 4.2.18
Current text:
4.2.18 CNAs MUST NOT assign CVE IDs for Vulnerabilities that have been deliberately implemented for educational and research purposes, for example, in Products such as OWASP WebGoat.
Problem:
4.2.18 excludes WebGoat because the artifact exists to be studied rather than operated. No population of users is at risk, so the record would have no consumer. The rule implements that reasoning through the wrong test, though: it keys on whether the vulnerability was deliberately implemented, rather than on whether the artifact was published to be run. WebGoat satisfies both, so the drafters never had to separate them.
Instructional sample applications are where the two come apart. A deliberately vulnerable teaching application is excluded from assignment, while a worse teaching application, whose author had never heard of SQL injection, is fair game. Identical purpose, identical absence of anyone at risk, opposite treatment.
The gap is being worked at scale. Seven sites distributing free PHP coursework and tutorial source (sourcecodester.com, code-projects.org, phpgurukul.com, itsourcecode.com, campcodes.com, projectworlds.in, codeastro.com) account for roughly 6,400 CVE Records since 2020.
Proposed change:
Add 4.2.18.1 at SHOULD NOT, structurally parallel to 4.2.10, so that CNA judgement under 4.4 and the presumption in 4.4.3 are preserved:
4.2.18.1 CNAs SHOULD NOT assign CVE IDs for Vulnerabilities in Products that the Supplier distributes as instructional or sample material rather than for operational use. A CNA SHOULD make that determination only where all of the following apply:
- the Supplier presents the Product as a learning resource, coursework template, demonstration, or sample implementation;
- the Supplier's installation guidance addresses only a local development environment, and provides no guidance for operational deployment;
- the Supplier does not publish versioned releases and does not issue Fixes.
This rule does not apply where the CNA has evidence that the Product is in operational use.
Section affected: 4.2.18
Current text:
Problem:
4.2.18 excludes WebGoat because the artifact exists to be studied rather than operated. No population of users is at risk, so the record would have no consumer. The rule implements that reasoning through the wrong test, though: it keys on whether the vulnerability was deliberately implemented, rather than on whether the artifact was published to be run. WebGoat satisfies both, so the drafters never had to separate them.
Instructional sample applications are where the two come apart. A deliberately vulnerable teaching application is excluded from assignment, while a worse teaching application, whose author had never heard of SQL injection, is fair game. Identical purpose, identical absence of anyone at risk, opposite treatment.
The gap is being worked at scale. Seven sites distributing free PHP coursework and tutorial source (sourcecodester.com, code-projects.org, phpgurukul.com, itsourcecode.com, campcodes.com, projectworlds.in, codeastro.com) account for roughly 6,400 CVE Records since 2020.
Proposed change:
Add 4.2.18.1 at SHOULD NOT, structurally parallel to 4.2.10, so that CNA judgement under 4.4 and the presumption in 4.4.3 are preserved: