Contrast CVE Shield
Contrast CVE Shield defends your applications against specific, known CVEs at runtime. Rather than detecting attack patterns, CVE Shield creates a precise containment boundary around the vulnerable code in a library.
If an attacker successfully triggers the vulnerability, CVE Shield blocks the exploit from reaching dangerous capabilities, such as starting a process, opening a network connection, or writing to the file system, while letting the library's normal, legitimate behavior continue unaffected.
CVE Shield is useful for the gap between a CVE being published and your team patching it. Instead of waiting on a patch cycle, CVE Shield gives you an immediate, evidence-based control: you can see whether a given CVE is being monitored or actively blocked in each of your environments.
CVE Shield supports the following agents:
Agent | Minimum supported version |
|---|---|
Java | 6.33.1 |
Node.js | 5.68.0 |
Python | 11.12.0 |
Flex | 3.3.0 |
.NET, Go, and PHP agent support will be available in a future release.
Enterprise support
Enterprise customers can use CVE Shield to monitor, block, or turn off monitoring per environment, as well as create incidents for exploited attacks.
Free limitations
New to Contrast? See Try Contrast for free to sign up and install an agent to see your first vulnerabilities. Learn what's included in the free tier.
Free-tier organizations can use CVE Shield to monitor or turn off monitoring, but can't block attacks, and don’t have access to incidents.
Includes runtime CVE-related data only. Assess-generated vulnerability findings (e.g., SQL injection, custom-code data-flow vulnerabilities) require a paid tier. If you are looking to evaluate Assess/ADR, contact Contrast Security Sales at +1 888 371 1333.
Set and customize protection levels
Under Policies > CVE Shield, you can:
Set the default protection level applied across your organization. See Set global default protection levels for details.
Customize the protection level for an individual CVE when the default doesn't fit your situation. See Customize protection by CVE to learn more.
To see which CVEs in your application inventory have CVE Shield coverage today, and which don't, see View your CVE Shields in Explorer.
See also
Sign up for Contrast CVE Shield Free
View your CVE Shields in Explorer