Review Contrast CVE Shield states (Northstar)
The CVEs page in Explorer shows you which CVEs in your libraries can actually be reached by an attacker, and whether they're protected. Use it to review CVE states across your organization.
Before you begin
An agent must be installed and configured on a service.
Steps
In Northstar, in the left navigation, go to Explorer > CVEs.
Review the list of CVEs detected across your instrumented services. Each row shows the CVE identifier, the affected library and version, the current status, and the services where Contrast detected this CVE.
To narrow the list, filter by status. For example, filter to Exploited and Exposed to prioritize the CVEs that need attention first.
CVE Shield status values
CVE Shield reports on what your application actually does at runtime. An agent observes whether the vulnerable code path in a library is ever called, which is the difference between a CVE being reachable (present somewhere in your dependency tree) and reached (its vulnerable code path has actually executed).
Northstar assigns every CVE it tracks one of the following states, based on whether the vulnerable code has been reached and whether CVE Shield is configured to protect it. The status values are listed below in priority order, so if a service has multiple CVEs in different states, Northstar surfaces the most severe status first. These same status values appear on the Issues CVE Shield Status column and the Explorer shield badges, so a CVE's status stays consistent no matter where you're looking at it.
Status | Meaning |
|---|---|
Exploited | An attacker has reached and maliciously used the CVE's vulnerable code. This state only applies to CVEs where CVE Shield can sandbox the vulnerable code (Monitor or Block mode). |
Blocked | Someone attacked the vulnerable part of this CVE, but CVE Shield stopped it. Blocking protection isn't available for CVE Shield Free tier. |
Exposed | The vulnerable code has been reached. In most cases this means only normal, non-malicious traffic has reached it and no attack has occurred. |
Protecting | CVE Shield is set up to block attacks on this CVE. Normal, non-malicious use has reached the vulnerable part of the code, but no attack has occurred. Protecting isn't available for CVE Shield Free tier; these accounts operate in Monitor protection mode only. |
Not Seen | This CVE has not been seen in the runtime operation. The vulnerable library code hasn't been reached yet. |
N/A | No shield exists for this CVE, or CVE Shield is turned off. |
A CVE can sit in Not Seen indefinitely if your application never calls the vulnerable function, even though a traditional SCA scanner would still flag it as present. If a CVE shows up in a separate dependency scan but doesn't appear the same way in CVE Shield, or appears in a different state than you'd expect, that's not a detection gap. CVE Shield reports on actual exposure instead of theoretical exposure.
Note
CVE Shield Free tier organizations can set global default protection to Off or Monitor, but not Block. Because Block mode is unavailable, Free tier organizations will never see a CVE reach the Blocked or Protecting status as both require Block mode to be active.
A paid tier license enables Block protection mode, and with it, the Blocked and Protecting statuses.
ADR customers have full CVE Shield functionality, including blocking. CVE Shield modes are an organization-wide setting, but you can customize protection by CVE.
If ADR and CVE Shield are both configured to act on the same vulnerable method, ADR's action takes precedence, and the event may not be reflected in a CVE Shield status at all.