You can use the CVE API that Red Hat maintains. It has a lot of options to search for a vulnerability given a CVE or other parameters, you can even run a search by components with a range of dates (before and after filters).
An example of the query that you may be interested in, will be something like this:
https://access.redhat.com/labs/securitydataapi/cve/CVE-2017-1000369.json
The output will be something like this (using the CVE you provided in your question):
{
"threat_severity": "Low",
"public_date": "2017-06-19T00:00:00",
"bugzilla": {
"description": "\nCVE-2017-1000369 Exim: Privilege escalation via multiple memory leaks\n ",
"id": "1457748",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1457748"
},
"cvss3": {
"cvss3_base_score": "2.9",
"cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"status": "draft"
},
"details": [
"\nExim supports the use of multiple \"-p\" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.\n "
],
"statement": "\nExim itself is not vulnerable to privilege escalation, but this particular flaw in exim can be used by the stackguard vulnerability (https://access.redhat.com/security/vulnerabilities/stackguard) to achieve privilege escalation.\n ",
"package_state": {
"product_name": "Red Hat Enterprise Linux 5",
"fix_state": "Will not fix",
"package_name": "exim",
"cpe": "cpe:/o:redhat:enterprise_linux:5"
},
"name": "CVE-2017-1000369"
}
The Complete Documentation for the API can be found here.
Warning: The data could be limited to components in Red Hat products, but from my experience using it, I did not have much problems with the information provided by the API. This API uses CVSS3 only, this could be a problem for you.
A second option (with CVSS2 support) could be the NVD/CVE as JSON files project hosted on Github, an example of a request with the same CVE that you posted will be:
https://olbat.github.io/nvdcve/CVE-2017-1000369.json
The output will be something like this:
{
"cve": {
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2017-1000369",
"ASSIGNER": "cve@mitre.org"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "exim",
"product": {
"product_data": [
{
"product_name": "exim",
"version": {
"version_data": [
{
"version_value": "4.89",
"version_affected": "<="
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "http://www.debian.org/security/2017/dsa-3888",
"name": "DSA-3888",
"refsource": "DEBIAN",
"tags": [
]
},
{
"url": "http://www.securityfocus.com/bid/99252",
"name": "99252",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "http://www.securitytracker.com/id/1038779",
"name": "1038779",
"refsource": "SECTRACK",
"tags": [
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2017-1000369",
"name": "https://access.redhat.com/security/cve/CVE-2017-1000369",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21",
"name": "https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21",
"refsource": "MISC",
"tags": [
"Mitigation",
"Third Party Advisory"
]
},
{
"url": "https://security.gentoo.org/glsa/201709-19",
"name": "GLSA-201709-19",
"refsource": "GENTOO",
"tags": [
]
},
{
"url": "https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt",
"name": "https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
]
}
]
},
"description": {
"description_data": [
{
"lang": "en",
"value": "Exim supports the use of multiple \"-p\" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time."
}
]
}
},
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"operator": "OR",
"cpe_match": [
{
"vulnerable": true,
"cpe23Uri": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.89"
}
]
}
]
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.5,
"impactScore": 1.4
},
"baseMetricV2": {
"cvssV2": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE",
"baseScore": 2.1
},
"severity": "LOW",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
},
"publishedDate": "2017-06-19T16:29Z",
"lastModifiedDate": "2017-11-04T01:29Z"
}
As you can see, it provides a lot of information that could be useful for your project (including CVSS V2), both projects are still active and updated, hope it helps.
