Weakness (CWE)
CWE-204: Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
How to prevent it (2 mitigations)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
-
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Source: MITRE CWE-204
14 results · Clear filters · Feed
-
High 7.3
phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-login
phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts b…
-
High 7.5
User Enumeration in Rolantis Information Technologies' Agentis
Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.
-
High 7.5
User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.
-
High 7.5
User Enumeration in GastroMenum's GastroMenum Web Panel
Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026.
-
High 7.5
Username Enumeration in Menulux Software's Menulux Portal
Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448.
-
High 7.5
Combodo iTop: User enumeration via password reset
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in versi…
-
High 8.6
Azure Stack HCI Information Disclosure Vulnerability
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
-
High 7.5
SiYuan before v3.7.4 Missing Authorization via block API
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lac…
-
High 7.2
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to…
-
High 7.1
Icinga 2 API users could access restricted values in filter expressions
Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authentica…
-
High 7.5
-
High 7.5
MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24
An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
-
High 8.6
SinoTrack GPS Receiver Weak Authentication
User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or th…
-
High 7.5
Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0
In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.