CWE-204: Observable Response Discrepancy, page 3
Filter
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
What the weakness is: CWE-204 at MITRE
Related attack patterns (CAPEC): 4
- CAPEC-331 ICMP IP Total Length Field Probe Likelihood: Medium · Severity: Low
- CAPEC-332 ICMP IP 'ID' Field Error Message Probe Likelihood: Medium · Severity: Low
- CAPEC-541 Application Fingerprinting Severity: Low
- CAPEC-580 System Footprinting Likelihood: Low · Severity: Low
The attack patterns MITRE's CAPEC relates to CWE-204, as MITRE names them. Credits.
Ask an AI about CWE-204
Show the prompt
Explain CWE-204: Observable Response Discrepancy and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/204.html and https://cve.bz/cve/cwe/204?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.9CVE-2021-47717EPSS 0.4%
IntelliChoice eFORCE Software Suite 2.5.9 contains a username enumeration vulnerability that allows attackers to enumerate valid users by exploiting the 'ctl00$MainContent$UserName' POST parameter. Attackers can send requests with valid us…
- 6.9CVE-2025-40806EPSS 0.5%
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determin…
- 5.3CVE-2025-65899EPSS 0.4%
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_pa…
- 5.3CVE-2025-12994EPSS 0.3%
Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December…
- 5.3CVE-2025-66307EPSS 0.3%
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Fo…
- 6.9CVE-2025-59116EPSS 0.3%
Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. Only version 4…
- 5.3CVE-2025-25236EPSS 0.3%
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying …
- 6.9CVE-2025-62236EPSS 0.3%
The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote attacker could determine valid email addresses, possibly aiding in further attac…
- 6.9CVE-2025-34155EPSS 0.5%
Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote…
- 6.9CVE-2025-34255EPSS 1.0%
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is a…
- 6.9CVE-2025-34254EPSS 1.0%
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with …
- 7.1CVE-2025-61907EPSS 0.4%
Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. Th…
- 6.5CVE-2025-61789EPSS 0.4%
Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hi…
- 4.3CVE-2025-42903EPSS 0.3%
A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality w…
- 5.3CVE-2025-58586EPSS 0.4%
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existi…
- 5.3CVE-2025-56764EPSS 0.3%
Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user" vs. "Wrong password"), allowing an attacker to enumerate valid usernames.
- 5.3CVE-2025-58442EPSS 0.3%
Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provid…
- 5.9CVE-2025-9824EPSS 0.3%
ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has…
- 2.9CVE-2025-9109EPSS 0.4%
A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email of the component Password Recovery Endpoint. The manipulation results in observa…
- 7.5CVE-2025-46390EPSS 0.3%
CWE-204: Observable Response Discrepancy
- 6.9CVE-2025-54834EPSS 0.6%
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in pla…
- 5.3CVE-2025-52899EPSS 0.3%
Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot…
- 4.3CVE-2025-54129EPSS 0.3%
HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response…
- 5.3CVE-2025-27451EPSS 0.4%
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existi…
- 7.5CVE-2025-3092EPSS 0.5%
An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
- 8.8CVE-2025-5485EPSS 0.4%
User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from …
- 5.3CVE-2025-49187EPSS 0.4%
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existi…
- 5.3CVE-2025-0163EPSS 0.3%
IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts.
- 5.3CVE-2025-3939EPSS 0.3%
Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before…
- 3.7CVE-2025-48015EPSS 0.3%
Failed login response could be different depending on whether the username was local or central.
- 6.9CVE-2024-51447EPSS 0.5%
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected application contains an observable response discrepancy vulnerability when validating u…
- 5.3CVE-2025-46736EPSS 0.4%
Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patc…
- 5.3CVE-2025-24342EPSS 0.5%
A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests.
- 5.5CVE-2025-30150EPSS 0.4%
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/accoun…
- 6.9CVE-2025-30280EPSS 0.5%
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix …
- 5.3CVE-2024-56476EPSS 0.3%
IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy.
- 5.3CVE-2025-31124EPSS 0.5%
Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the …
- 6.9CVE-2025-2910EPSS 0.4%
User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages.
- 5.3CVE-2024-55198EPSS 0.5%
User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker to enumerate users through discrepancies in the responses.
- 5.3CVE-2025-24023EPSS 0.3%
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This …
- 5.3CVE-2025-1101EPSS 0.7%
A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests.
- 7.5CVE-2025-23193EPSS 0.3%
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does …
- 6.9CVE-2025-24980EPSS 0.5%
pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has b…
- 5.3CVE-2023-37413EPSS 0.3%
IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy.
- 4.3CVE-2023-47159EPSS 0.3%
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable discrepancy in request responses.
- 5.3CVE-2024-35114EPSS 0.4%
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.
- 6.9CVE-2025-0693EPSS 0.4%
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
- 6.9CVE-2025-23214EPSS 0.7%
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist…
- 5.3CVE-2024-36510EPSS 0.7%
An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all versions, 7.0 all versions, 6.4 all versions …
- 3.7CVE-2024-42174EPSS 0.3%
HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames.