Review Contrast CVE Shield states (Northstar)
The Contrast CVE Shield page in Explorer shows you which CVEs in your libraries can actually be reached by an attacker, and whether they're protected. Use it to review CVE states across your organization, and to turn on protection where available.
Before you begin
An agent must be installed and configured on a service. See install a Java agent directly or install a Java agent with Kubernetes Helm Chart for details.
Steps
In the left navigation, select Explorer > CVEs to access the CVE Shield table.
Review the list of CVEs detected across your instrumented services. Each row shows the CVE identifier, the affected library and version, the current status, and the services where Contrast detected this CVE.
To narrow the list, filter by status. For example, filter to Exploited and Exposed to prioritize the CVEs that need attention first.
CVE Shield status values
CVE Shield reports on what your application actually does at runtime. An agent observes whether the vulnerable code path in a library is ever called, which is the difference between a CVE being reachable (present somewhere in your dependency tree) and reached (its vulnerable code path has actually executed).
Northstar assigns every CVE it tracks one of the following states, based on whether the vulnerable code has been reached and whether CVE Shield is configured to protect it. The status values are listed below in priority order, so if a service has multiple CVEs in different states, Northstar surfaces the most severe status first. These same status values appear on the Issues CVE Shield Status column and the Explorer shield badges, so a CVE's status stays consistent no matter where you're looking at it.
Status | Meaning |
|---|---|
Exploited | An attacker has reached and maliciously used the CVE's vulnerable code. This state only applies to CVEs where CVE Shield can sandbox the vulnerable code (Monitor or Block mode). It does not apply to CVEs marked Visibility Only; those CVEs cannot reach this state under any circumstances, regardless of whether an attack occurred. See Exposed below for additional details. |
Blocked | Someone attacked the vulnerable part of this CVE, but CVE Shield stopped it. Blocking isn't available for CVE Shield Free tier. |
Exposed | The vulnerable code has been reached. In most cases this means only normal, non-malicious traffic has reached it and no attack has occurred. For CVEs that cannot be sandboxed (shown as Visibility Only), CVE Shield cannot distinguish reachability from active exploitation. For these CVEs, Exposed is the only state CVE Shield can report, even if an actual attack occurred. |
Protecting | CVE Shield is set up to block attacks on this CVE. Normal, non-malicious use has reached the vulnerable part of the code, but no attack has occurred. Protecting isn't available for CVE Shield Free; these accounts operate in Monitor mode only. |
Not Seen | This CVE has not been seen in the runtime operation. The vulnerable library code hasn't been reached yet. |
N/A | No shield exists for this CVE, or CVE Shield is turned off. |
A CVE can sit in Not Seen indefinitely if your application never calls the vulnerable function, even though a traditional SCA scanner would still flag it as present. If a CVE shows up in a separate dependency scan but doesn't appear the same way in CVE Shield, or appears in a different state than you'd expect, that's not a detection gap. CVE Shield is reporting on actual exposure instead of theoretical exposure.
Note
Blocking and Protecting aren't available for CVE Shield Free Tier. These accounts operate in Monitor mode only.
ADR customers have full CVE Shield functionality, including blocking. CVE Shield modes are an organization-wide setting, but you can use the Override feature to manage the mode of specific CVEs.
If ADR and CVE Shield are both configured to act on the same vulnerable method, ADR's blocking takes precedence, and the event may not be reflected in CVE Shield's status.