Review Contrast CVE Shield states (Northstar)
The CVEs page in Explorer shows you which CVEs in your libraries can actually be reached by an attacker, and whether they're protected. Use it to review CVE states across your organization.
Before you begin
An agent must be installed and configured on a service.
Steps
In Northstar, in the left navigation, go to Explorer > CVEs.
Review the list of CVEs detected across your instrumented services. Each row shows the CVE identifier, the affected library and version, the current status, and the services where Contrast detected this CVE.
To narrow the list, filter by status. For example, filter to Exploited and Exposed to prioritize the CVEs that need attention first.
CVE Shield status values
CVE Shield reports on what your application actually does at runtime. An agent observes whether the vulnerable code path in a library is ever called, which is the difference between a CVE being present in a library loaded by an application, and a CVE that is reachable or reached (its vulnerable code path has actually executed
Northstar assigns every CVE it tracks one of the following states, based on whether the vulnerable code has been reached and whether CVE Shield is configured to protect it. The status values are listed below in priority order, so if a service has multiple CVEs in different states, Northstar surfaces the most severe status first. These same status values appear on the Issues CVE Shield Status column and the Explorer shield badges, so a CVE's status stays consistent no matter where you're looking at it.
Status | Meaning |
|---|---|
Exploited | An attacker has reached and maliciously used the CVE's vulnerable code. This state only applies to CVEs where CVE Shield can sandbox the vulnerable code (Monitor mode only). |
Blocked | Someone reached the vulnerable part of this CVE, and CVE Shield blocked a potential exploit. Blocking protection isn't available for CVE Shield Free tier. |
Exposed | The vulnerable code has been reached. In most cases this means only normal, non-malicious traffic has reached it and no attack was identified. |
Protecting | CVE Shield is set up to block attacks on this CVE, but no attack has occurred. Protecting isn't available for CVE Shield Free tier; these accounts operate in Monitor mode only. |
Not Seen | This CVE has not been seen in the runtime operation. The vulnerable library code hasn't been reached yet. |
No Shield | No shield policy is available to monitor or block this CVE. This status also appears when the agent version is too old to support CVE Shield. See CVE Shield documentation for details on minimum agent version support. |
Off | A Monitor or Block policy exists for this CVE, but it's turned off for this environment. Block isn't available for CVE Shield Free tier; these accounts operate in Monitor protection mode only. |
A CVE can sit in Not Seen indefinitely if your application never calls the vulnerable function, even though a traditional SCA scanner would still flag it as present. If a CVE shows up in a separate dependency scan but doesn't appear the same way in CVE Shield, or appears in a different state than you'd expect, that's not a detection gap. CVE Shield reports on actual exposure instead of theoretical exposure.
The Off status here is the mode you configure for an environment, not the CVE Shield status shown for an individual CVE in Explorer or Issues. If a CVE's status shows as Off, it means a Monitor or Block policy already exists for that CVE, and this environment's mode is what's currently set to Off.
Note
CVE Shield Free tier organizations can set global default protection to Off or Monitor, but not Block. Because Block mode is unavailable, Free tier organizations will never see a CVE reach the Blocked or Protecting status as both require Block mode to be active.
A paid tier license enables Block protection mode, and with it, the Blocked and Protecting statuses.
ADR customers have full CVE Shield functionality, including blocking. CVE Shield modes are an organization-wide setting, but you can customize protection by CVE.
If ADR and CVE Shield are both configured to act on the same vulnerable method, ADR's action takes precedence, and the event may not be reflected in a CVE Shield status at all.