Defining the default CPE for component versions

CPE, or Common Platform Enumeration, is a standardized system for identifying software components and their versions. It is used in Software Bill of Materials (SBOMs) to facilitate the tracking of vulnerabilities associated with specific components.

As CPE becomes a widely adopted identifier for SBOMs, particularly when importing SBOMs from a suppliers, Black Duck includes this information automatically (when available). This ensures that you can rely on accurate and complete data in your SBOMs without needing to manually locate and update the CPE field for each component in your BOMs.

How to find a component version's CPEs

Component version CPEs can be found on:

Defining a default CPE

If the KnowledgeBase does not have any associated CPEs for the component version, you can add or create a default CPE for this component version. Only one CPE can be assigned in this way.


CPE search field

If the KnowledgeBase has associated CPEs for the component version and no default CPE has been assigned, an additional info box will accompany the text field above, displaying a list of CPEs automatically selected by Black Duck. The CPEs selected are the first five IDs associated with the component version from the KnowledgeBase, sorted alphabetically.

If you choose to define a default CPE for this component version, you can use the provided text field to search the KnowledgeBase for existing CPE IDs associated with the component version or create a custom default CPE. Only one CPE can be assigned in this way.


CPE configuration

If a default CPE has been assigned, you can delete it by clicking the x in the text field and clicking the Save button.


Default CPE assigned

Where to find CPEs in the SBOM report

CPEs associated with a component version can be found in the SBOM report generated by Black Duck:

  • SPDX format: CPEs are listed under the externalReferences section of the relevant component entry. The reference type for a CPE is SECURITY.

  • CycloneDX: CPEs appear in the cpe field within the properties section of the corresponding component.