Weakness (CWE)
CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
-
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Source: MITRE CWE-203
285 results · Clear filters · Feed
-
Medium 5.3
An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.…
-
Medium 5.5
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 5.5
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 4.0
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 5.3
Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated atta…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ven…
-
Medium 5.3
Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significant…
-
Medium 5.3
Cisco Integrated Management Controller Username Enumeration Vulnerability
A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication responses sent back from t…
-
Medium 5.9
Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information dis…
-
Medium 5.5
Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferenc…
-
Medium 5.5
Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory a…
-
Medium 5.5
x86: fix user address masking non-canonical speculation issue
In the Linux kernel, the following vulnerability has been resolved: x86: fix user address masking non-canonical speculation issue It turns out that AMD has a "Meltdown Lite(tm)" issue with non-canonical accesses in kernel space. And so using just the high bit…
-
Medium 5.3
ZimaOS vulnerable to Username Enumeration via API Responses
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Server-IP>/v1/users/login` in ZimaOS returns distinct responses based on whether a username exist…
-
Medium 5.9
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/util…
-
Medium 5.9
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/…
-
Medium 5.3CVE-2024-48644 Public exploit
Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23…
-
Medium 4.3
Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are…
-
Medium 4.3
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnost…
-
Medium 5.6
Windows Cryptographic Information Disclosure Vulnerability
Windows Cryptographic Information Disclosure Vulnerability
-
Medium 5.3
Django allows enumeration of user e-mail addresses
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset r…
-
Medium 5.3
By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine i…
-
Medium 5.3
Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable…
-
Medium 4.2
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an EC…
-
Medium 4.1
ECDSA nonce bias caused by truncation
Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic curve. Meaning k = r mod n. The division used during the reduction estimates a factor q_e by dividing…
-
Medium 5.3
Zitadel has an "Ignoring unknown usernames" vulnerability
Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if…
-
Medium 5.3
In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiv…
-
Medium 5.3CVE-2024-39891 Exploited
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoi…
KEV Jul 23, 2024 -
Medium 4.0
Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of …
-
Medium 5.3
A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Fir…
-
Medium 4.3
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were fu…
-
Medium 5.9
PHP is vulnerable to the Marvin Attack
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.…
-
Medium 5.3
IBM i information disclosure
IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malicious actor to gather information about SST users that can be targeted in further attacks. IBM X-Force …
-
Medium 6.5
An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hij…
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and i…
-
Medium 5.9
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
-
Medium 5.3
In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared …
-
Medium 6.3
Application users enumeration in CDeX
This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1.