CVE and ATT&CK - Question about attack-stix-data HOT 2 CLOSED

Your understanding sounds correct.

CVE is a knowledge-base that aggregates known vulnerabilities. It serves as a historical reference and as a source of truth for vulnerabilities.

ATT&CK is a vendor-agnostic framework that can characterize vulnerabilities to help defenders analyze or break down the methodologies behind the vulnerability.

STIX is a common format by which cyber threat intelligence (CTI) information can be exchanged. ATT&CK is represented in STIX.

This article discusses how CVE and ATT&CK can be used in parallel to assess vulnerability impacts.

from attack-stix-data.

ATT&CK and CVE are also managed by completely separate organizations within MITRE, with no overlap in staff. ATT&CK describes behaviors that real-world adversaries have performed in the wild, which often don't involve vulnerabilities (most of ATT&CK is adversaries leveraging intentional features). MITRE has quite a few different frameworks beyond ATT&CK and CVE, if you wanted to look at a more closely aligned set you could check out CVE, CWE, and CAPEC.

from attack-stix-data.