Automated discovery (determination) and assignment

[zmanion]

(from CVEProject/strategic-planning-working-group#4)

Consider adding rules about how to handle automated vulnerability discovery (determination in the curent CNA Operational Rules revision) and assignment. Related:

https://cve.mitre.org/data/board/archives/2015-11/msg00010.html

ossf/wg-vulnerability-disclosures#123

Specification: OpenSSF Compliant Automated Vulnerability Fix Campaign

User Stories

[zmanion]

The details matter, but automated vulnerabilit discovery (determination) may meet the requirement that for evidence of a vulnerability. Setting aside important vulnerability coordination issues, automated CVE ID reservation and record publication should be allowed. This has the potential to add "a lot" of CVE IDs to the corpus.