cve.bz

CWE-204: Observable Response Discrepancy, page 4

Filter

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

What the weakness is: CWE-204 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-331 ICMP IP Total Length Field Probe Likelihood: Medium · Severity: Low
  • CAPEC-332 ICMP IP 'ID' Field Error Message Probe Likelihood: Medium · Severity: Low
  • CAPEC-541 Application Fingerprinting Severity: Low
  • CAPEC-580 System Footprinting Likelihood: Low · Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-204, as MITRE names them. Credits.

Ask an AI about CWE-204

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-204: Observable Response Discrepancy and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/204.html and https://cve.bz/cve/cwe/204?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.3CVE-2024-13198EPSS 0.7%

    A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack…

  2. 6.3CVE-2024-13028EPSS 0.8%

    A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the file /login. The manipulation of the argument username leads to observable response…

  3. 6.3CVE-2024-12663EPSS 0.4%

    A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the component Login. The manipulation of the argument username leads to observable respo…

  4. 5.3CVE-2022-20633EPSS 0.8%

    A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device. This vulnerability is due to differences in aut…

  5. 5.3CVE-2024-47129EPSS 0.1%

    The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.

  6. 5.3CVE-2024-41715EPSS 0.1%

    The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.

  7. 6.9CVE-2024-8651EPSS 0.4%

    A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks. This issue affects NetCat CMS v. 6.4.0.241…

  8. 5.3CVE-2024-34336EPSS 0.4%

    User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality.

  9. 6.9CVE-2023-49069EPSS 0.4%

    A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.11 only if the basic authentication mec…

  10. 7.5CVE-2024-42343EPSS 0.3%

    Loway - CWE-204: Observable Response Discrepancy

  11. 7.5CVE-2024-38431EPSS 0.4%

    Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy

  12. 5.8CVE-2024-40627EPSS 0.6%

    Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware…

  13. 5.3CVE-2024-39912EPSS 0.4%

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCrede…

  14. 5.3CVE-2023-33859EPSS 0.4%

    IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697.

  15. 5.3CVE-2024-39211EPSS 1.1%

    Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists.

  16. 5.3CVE-2024-36996EPSS 0.4%

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they …

  17. 7.5CVE-2024-38322EPSS 0.4%

    IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.

  18. 6.3CVE-2024-6056EPSS 0.7%

    A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulat…

  19. 3.3CVE-2024-31870EPSS 0.2%

    IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor …

  20. 5.3CVE-2024-33856EPSS 0.4%

    An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint.

  21. 5.3CVE-2023-27283EPSS 0.5%

    IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545.

  22. 5.3CVE-2021-20556EPSS 0.5%

    IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames. IBM X-Force ID: 199181.

  23. 7.5CVE-2024-28232EPSS 0.6%

    Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in …

  24. 5.3CVE-2024-28868EPSS 0.5%

    Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disabl…

  25. 5.3CVE-2024-1145EPSS 0.5%

    User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.

  26. 3.7CVE-2024-2482EPSS 0.8%

    A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /check_availability.php of the component HTTP POST Reques…

  27. 6.5CVE-2023-46170EPSS 0.5%

    IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names.

  28. 7.5CVE-2024-24766EPSS 0.8%

    CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enume…

  29. 5.3CVE-2023-38362EPSS 0.6%

    IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814.

  30. 3.3CVE-2023-50306EPSS 0.2%

    IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.

  31. 5.3CVE-2024-25146EPSS 0.6%

    Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exi…

  32. 4.3CVE-2023-23584EPSS 0.5%

    An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable. This issue affects: Gallagher Command Centre 8.70 pr…

  33. 5.3CVE-2023-37831EPSS 0.6%

    An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.

  34. 5.3CVE-2023-4095EPSS 0.5%

    User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered users in the application, obtaining the necessary information to perform more co…

  35. 5.3CVE-2023-41885EPSS 0.6%

    Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of …

  36. 5.3CVE-2023-3221EPSS 0.6%

    User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the password recovery function to enumerate all users in the database.

  37. 5.3CVE-2023-40179EPSS 0.4%

    Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter…

  38. 4.3CVE-2023-39343EPSS 0.6%

    Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Sulu Installation not using the old Symfony …

  39. 5.3CVE-2023-37217EPSS 0.4%

    Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy

  40. 5.3CVE-2023-35698EPSS 0.8%

    Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.

  41. 5.3CVE-2023-3336EPSS 0.6%

    TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enabl…

  42. 5.3CVE-2023-31186EPSS 0.4%

    Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy

  43. 5.3CVE-2023-28412EPSS 0.5%

    When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.

  44. 5.3CVE-2023-32346EPSS 0.5%

    Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information based on whether the serial number of a device has already been claimed, the MAC a…

  45. 5.3CVE-2023-23449EPSS 0.8%

    Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames by analyzing challenge responses…

  46. 5.3CVE-2023-27464EPSS 0.5%

    A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions <…

  47. 5.3CVE-2023-1540EPSS 0.6%

    Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.

  48. 6.5CVE-2022-39228EPSS 0.6%

    vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots fr…

  49. 5.3CVE-2019-19030EPSS 2.0%

    Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.

  50. 5.3CVE-2022-41697ExploitEPSS 20%

    A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigg…