Are we affected by this CVE

Contrast CVE Shield gives you this answer in under two minutes. It watches your running application and tells you whether a vulnerable location in the library is actually being reached and used, not just present in your dependency tree or loaded by the application.

How it works

Once a Contrast agent is deployed, CVE Shield gathers the libraries that the agent has observed being loaded into memory and analyzes them to determine which CVEs are present in the library and importantly the vulnerable locations in the library. From there it directs the agent to watch traffic specifically at those locations, not the library as a whole, to keep false positives down. A library merely being present doesn't put you at risk; a library actually running its vulnerable code path does.

New CVEs typically show up in this list within about 15 minutes of the vulnerable library being identified, so you're not waiting on a manual review cycle to know something new applies to you.

Before you start

To use Contrast CVE Shield, you need the following:

A Contrast CVE Shield account with an agent (minimum version 6.33.0) installed.
A Java application you can connect.

New to Contrast? See the Quickstart Guide: Contrast CVE Shield Free Tier to get started with Contrast CVE Shield.

Already a Northstar Contrast customer? Use CVE Shield today to determine if you’re affected by CVEs.

If you haven't installed an agent yet, do that first. Nothing will show up in Northstar until an agent is reporting. Learn how to install a Java agent directly, or with a Kubernetes Helm Chart.

Fast Path: Go to Issues

This is the fastest path to an answer. Issues contains a full inventory of every CVE detected across your onboarded applications.

Search for the CVE ID you're asking about to see the following details:

CVE Shield status. This is your direct answer.
Exposed or Exploited means yes, you're affected.
Not Seen means the vulnerable code exists in your dependencies but hasn't run yet, so you're not currently at risk from it.
N/A usually means no active agent is loading that library right now.
Max CVE Contrast score. Severity tells you how bad this CVE is in the abstract. Max CVE Contrast score adjusts that for your environment, factoring in whether the code is reachable at all. A critical-severity CVE that's unreachable in your app scores lower here than a medium-severity CVE your app actually executes. Use this score, not the raw severity, to decide what to work on first.
Total applications, total environments, and total library versions. This is your blast radius. If a CVE touches one application in one environment, it's a contained fix. If it touches several applications across production and staging, it's a portfolio-wide problem that probably needs a coordinated response rather than a single ticket.
EPSS and KEV. This tells you whether the danger is bigger than your organization. A high EPSS score or a KEV flag means this CVE is being actively exploited somewhere on the internet right now, independent of whether it's hit you yet. Pair a KEV flag with an "Exposed" status and you have an urgent problem.

Not seeing data? See Troubleshooting: Agent Not Reporting Data When Connecting Your First Application for details.

What this means for you

Developers: Filter by application to check whether the service you own is the one carrying the vulnerable library, and check the status before you assume you need to act.
AppSec and security engineers: Use total applications and total environments to gauge organization-wide blast radius before deciding what to escalate, and cross-check EPSS or KEV to prioritize across many open CVEs at once.
Engineering and security leaders: Max CVE Contrast score gives you a fast, environment-aware read on priority when you're deciding where to point a team's time this week.

If you're exposed or exploited, drill in

A status of Exposed or Exploited means it's worth a closer look. The Contrast Score is updated dynamically based on the status to help prioritize remediation. Where you go next depends on what you need to know.

Overview. Go here for the underlying vulnerability record. This is where a developer assigned to remediate the CVE will spend most of their time.
Observations. Go here if the status is Exploited. This is the confirmed attack record, with what was detected and when, and it's the starting point for a security or incident response review. It includes forensic detail for a security engineer building a fuller picture of what happened.

Use the Issue filter panel to narrow by severity, environment, or application if you're working across more than one app.

Keep watching with Insights

Once you've answered the question for a specific CVE, Insights is where you go to track posture over time rather than to start your search.

The Contrast posture score gauge gives engineering and security leaders a single trend line for overall exposure, and Top 5 open issues and Top 5 open incidents surface what needs attention across every onboarded application without you having to check each CVE by hand.

Understand every CVE Shield status

CVE Shield tracks six possible states. CVE Shield Free tier customers will see four of them, since the other two depend on blocking, which is a paid CVE Shield capability. Also available to existing ADR customers.

Status	What it means	CVE Shield Tier
Not Seen	The vulnerable code hasn't been reached by your application yet.	Free
Exposed	Normal, non-malicious traffic has reached the vulnerable code.	Free
Exploited	An actual attack attempt against the vulnerable code was detected.	Free
N/A	Status doesn't apply, typically because the library isn't loaded by an active agent.	Free
Protecting	CVE Shield is set up to block attacks on this CVE. Non-malicious use has reached the code, but no attack has occurred yet.	Enterprise
Blocked	An attack against this CVE was actively stopped before it could do anything.	Enterprise

Free tier tells you. Ready to block?

CVE Shield Free tier covers reachability, monitoring, attack detection and prioritization. It will tell you quickly whether you're affected, how bad it is, and how far it's spread.

What the free tier doesn't do is stop an attack in progress. Detecting an exploited CVE is not the same as blocking it. If you need CVE Shield to actively block exploitation attempts on a CVE while you patch, that's the Protecting and Blocked capability detailed above, and it requires upgrading to CVE Shield Pro or Enterprise.

Keep in mind that even after a block succeeds, the score doesn't drop. The vulnerability itself still needs to be fixed by your development team. Blocking buys time, but it doesn't replace the remediation.

Ready to go from monitoring to blocking? Use Contact Sales in the product, or reach out to your Contrast rep, to talk about CVE Shield Pro or Enterprise.

Understand free limits

See What is CVE Monitoring versus Blocking, Understanding Capacity Limits, Data Retention Policies, and Free Tier Support Model for details.

Need more help?

Use the Community Support link in the bottom left corner of the Northstar web interface to create an account on the Gather Community Forum.