Weakness (CWE)
CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
-
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Source: MITRE CWE-203
460 results · Feed
-
Medium 4.3
Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetoot…
-
Medium 5.9
ginuerzh/gost vulnerable to Timing Attack
gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a s…
-
High 7.5
Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.
-
Unscored —
OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial d…
-
High 7.7
TIBCO EBX® Add-ons Path Traversal
The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to read system files that are accessible to the web server. Affected releases are TIBCO Software Inc.'s TIB…
-
Medium 4.8
Non-constant time HMAC comparison in Adyen plugin in Saleor
Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the sec…
-
Medium 5.3
HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this informat…
-
High 7.5
The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may af…
-
Medium 5.9
IBM Spectrum Virtualize information disclosure
IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518.
-
Medium 5.5
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.…
-
High 7.5
The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmw…
-
Medium 6.5
Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Report…
-
Medium 5.3
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration …
-
Medium 5.3CVE-2023-30458 Public exploit
A username enumeration issue was discovered in Medicine Tracker System 1.0. The login functionality allows a malicious …
-
High 7.5
IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic
io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/p…
-
Critical 9.1
IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication
io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/ke…
-
Medium 6.5CVE-2022-34125 Public exploit
front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive informat…
-
High 7.5
SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows atta…
-
Medium 5.0
Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side chann…
-
High 7.5
An issue was discovered in MCUBO ICT through 10.12.4 (aka 6.0.2). An Observable Response Discrepancy can occur under th…
-
Medium 5.3
Argo CD authenticated but unauthorized users may enumerate Application names via the API
An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.
-
Medium 5.3
Observable Timing Discrepancy in answerdev/answer
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Observable Response Discrepancy in answerdev/answer
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
/user/sessions endpoint allows detecting valid accounts
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
-
Medium 5.3
Time discrepancy in authentication responses in OpenSearch
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issu…
-
Medium 5.3
Observable Response Discrepancy in vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernam…
-
Medium 5.9
The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerabil…
-
High 7.4
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can…
-
Medium 5.9
Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …
-
Medium 5.3
Observable Discrepancy in healthchecks/healthchecks
Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.
-
Low 2.6
michaelliao jopenid OpenIdManager.java getAuthentication timing discrepancy
A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. The co…
-
High 7.4
Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator
wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.…
-
Medium 5.3
In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error m…
-
Low 2.6
viafintech Barzahlen Payment Module PHP SDK Webhook.php verify timing discrepancy
A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. The complexity of…
-
Medium 4.3
Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-or…
-
Low 3.3CVE-2022-47952 Public exploit
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists,…
-
Low 2.6
OpenShift OSIN CheckClientSecret timing discrepancy
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 86126…
-
Low 2.6
cocagne pysrp _ctsrp.py calculate_x information exposure
A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version…
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUser…