Regarding the Microsoft Security Update Supersedence and CPE Correspondence Issues about msrc-microsoft-security-updates-api HOT 4 OPEN

Using the MSRC API you get the productname and its CVE.
Using additional code, you can then visit for example https://nvd.nist.gov/vuln/detail/CVE-2021-1675 and parse the page to extract CPE.
NIST may also have an API to match the product name to its CPE format.

from msrc-microsoft-security-updates-api.

We want to correlate the CVE/CPE from NIST, with the CVE/ProductName from the CVRF API, because scanning tools report CVE & Installed CPE's, and we want to calculate the KB specific to the product to apply to the devices. Fuzzy matching the product name isn't yielding the best result. For example, values like "Service Pack 1" vs "SP1".
I see some of the other vendors have included CPE values as separate fields in the XLM/JSON, which works well for us.
Can you at least comma separate the segments for product, vendor, version and anything else, in the full product name?

from msrc-microsoft-security-updates-api.

up ? We are also interested having CPE in the MSRC update json files
Thnks !

from msrc-microsoft-security-updates-api.

hi, do you find any approach to match
product name VS CPE
Microsoft Exchange Server 2016 Cumulative Update 17 VS
cpe:2.3🅰️microsoft:exchange_server:2016:cumulative_update_17:::::: ?

from msrc-microsoft-security-updates-api.