Weakness (CWE)
CWE-204: Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
How to prevent it (2 mitigations)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
-
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Source: MITRE CWE-204
230 results · Feed
-
Medium 5.3
Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
-
Medium 6.9
Cosmos userbase checking vulnerability
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist or not in the datab…
-
Medium 4.9
An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versio…
-
Low 3.7
HCL MyXalytics is affected by username enumeration vulnerability
HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames.
-
Low 3.7
langhsu Mblog Blog System login observable response discrepancy
A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack remotely. The compl…
-
Low 3.7
Antabot White-Jotter login observable response discrepancy
A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the file /login. The manipulation of the argument username leads to observable response discrepancy. The at…
-
Low 3.7
funnyzpc Mee-Admin Login login observable response discrepancy
A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the component Login. The manipulation of the argument username leads to observable response discrepancy. The…
-
Medium 5.3
Cisco Enterprise Chat and Email Username Enumeration Vulnerability
A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device. This vulnerability is due to differences in authentication responses t…
-
Medium 5.3
Django allows enumeration of user e-mail addresses
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset r…
-
Medium 4.3
goTenna Pro ATAK Plugin Observable Response Discrepancy
The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.
-
Medium 4.3
Observable Response Discrepancy in goTenna Pro
The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.
-
Medium 6.9
Netcat CMS: user enumeration
A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly ot…
-
Medium 4.3
Users enumeration - weak password login
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid c…
-
Medium 5.3
User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists …
-
Medium 5.3
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mec…
-
Medium 5.3
Loway - CWE-204: Observable Response Discrepancy
Loway - CWE-204: Observable Response Discrepancy
-
Medium 5.3
Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy
Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy
-
Medium 5.3
Enumeration of valid usernames in web-auth/webauthn-lib
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any c…
-
Medium 5.8
OpaMiddleware does not filter HTTP OPTIONS requests
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `O…
-
Medium 5.3
IBM Security ReaQta information disclosure
IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697.
-
Medium 5.3CVE-2024-39211 Public exploit
Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response…
-
Medium 5.3
Information Disclosure of user names
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive…
-
Medium 5.3
IBM Storage Defender information disclosure
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.
-
Low 3.7
nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancy
A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulation of the argument …
-
Low 3.3
IBM i information disclosure
IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information…
-
Medium 5.3
An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the …
-
Medium 5.3
IBM Aspera Orchestrator information disclosure
IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545.
-
Medium 5.3
IBM Cognos Controller information disclosure
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames. IBM X-Force ID: 199181.
-
Medium 6.2
Username Enumeration in CasaOS via bypass of CVE-2024-24766
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has b…
-
Low 3.7
Umbraco possible user enumeration vulnerability
Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login s…
-
Medium 5.3
Observable Response Discrepancy at Alma Devklan Blog
User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.
-
Low 3.7
Surya2Developer Hostel Management Service HTTP POST Request check_availability.php observable response discrepancy
A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /check_availability.php of the component HTTP POST Request Handler. The manip…
-
Medium 6.5
IBM DS8900F information disclosure
IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names.
-
Medium 6.2
CasaOS Username Enumeration
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS user…
-
Medium 5.3
IBM CICS TX information disclosure
IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814.
-
Medium 4.0
IBM Common Licensing information disclosure
IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.
-
Medium 5.3
Liferay Portal allows attackers to discover the existence of sites
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user do…
-
Medium 4.3
An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to …
-
Unscored —
An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server r…
-
Medium 5.3
User enumeration vulnerability in Fujitsu Arconte Áurea
User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered users in the application, obtaining the necessary information to perform more complex attacks on the…