Drop support for CAPEC ID

[jayjacobs]

The recent CVE Survey (April 2025) asked respondents about the value of fields and the CAPEC data ranked at the very bottom:

The topic to remove the CAPEC ID was raised in the QWG (as a result of the survey) on 2025-05-12 and to support that discussion I wanted to share some data points about the CAPEC data point.

Here is an example of a recent CVE with CAPEC ID supplied:

            "impacts": [
                {
                    "capecId": "CAPEC-175",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-175 Code Inclusion"
                        }
                    ]
                }
            ],

This is the monthly counts of CVE records published with a CAPEC, along with the percent of monthly published CVEs with CAPEC IDs.

And of the 14,806 unique CVEs with CAPEC ID we see 256 unique CNAs (assignerShortName). This is how the proportion of the CVEs with CAPEC are sourced from CNAs: