Drop support for CAPEC ID

[jayjacobs]

The recent CVE Survey (April 2025) asked respondents about the value of fields and the CAPEC data ranked at the very bottom:

The topic to remove the CAPEC ID was raised in the QWG (as a result of the survey) on 2025-05-12 and to support that discussion I wanted to share some data points about the CAPEC data point.

Here is an example of a recent CVE with CAPEC ID supplied:

            "impacts": [
                {
                    "capecId": "CAPEC-175",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-175 Code Inclusion"
                        }
                    ]
                }
            ],

This is the monthly counts of CVE records published with a CAPEC, along with the percent of monthly published CVEs with CAPEC IDs.

And of the 14,806 unique CVEs with CAPEC ID we see 256 unique CNAs (assignerShortName). This is how the proportion of the CVEs with CAPEC are sourced from CNAs:

[chandanbn]

A negative security impact is a prerequisite for issuing a CVE. If a bug does not have a potential or demonstrable negative security impact, it should not be assigned a CVE. CAPEC seems close to a good dictionary of security impacts. If there are alternatives please suggest.

Rather than removing it, I suggest make the CVE description optional if all of the (a) problem type, (b) impact and (3) a base CVSS metrics are present in a CVE record. Currently these are optional since a CNA is expected to include them in the prose of CVE description.