Weaknesses of type CWE-204

191 results

Vazamento de informações através de respostas diferenciadas

A aplicação retorna respostas diferentes (tempo de processamento, mensagens de erro, código HTTP, tamanho da resposta) dependendo do estado interno do sistema, permitindo que atacantes deduzam informações sensíveis sem autorização. Por exemplo, responder com 'usuário não encontrado' versus 'senha incorreta' vaza a existência de contas.

Example

Um formulário de login que retorna 'usuário inexistente' para um email não cadastrado, mas 'credenciais inválidas' quando o email existe, permite que invasores enumerem contas válidas da plataforma sem precisar quebrar senhas.

How to mitigate

Padronize todas as respostas de erro (mensagens e tempo de processamento) para cenários de falha similares. Use mensagens genéricas como 'credenciais inválidas' independente do motivo real, e implemente rate limiting para dificultar enumeração automatizada.

CVE-2022-20633MEDIUMCisco Enterprise Chat and Email Username Enumeration VulnerabilityEPSS 0.8%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%CVE-2024-13028MEDIUMAntabot White-Jotter login observable response discrepancyEPSS 0.7%CVE-2025-1101MEDIUMA CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatEPSS 0.7%CVE-2024-36510MEDIUMAn observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5EPSS 0.7%CVE-2024-13198MEDIUMlanghsu Mblog Blog System login observable response discrepancyEPSS 0.7%CVE-2024-6056MEDIUMnasirkhan Laravel Starter Password Reset forgot-password observable response discrepancyEPSS 0.7%CVE-2023-1540MEDIUMObservable Response Discrepancy in answerdev/answerEPSS 0.6%CVE-2026-28288MEDIUMDify has a user enumeration issueEPSS 0.6%CVE-2022-39315MEDIUMKirby CMS vulnerable to user enumeration in the brute force protectionEPSS 0.6%CVE-2025-23214MEDIUMCosmos userbase checking vulnerabilityEPSS 0.6%CVE-2024-28232MEDIUMUsername Enumeration in CasaOS via bypass of CVE-2024-24766EPSS 0.6%CVE-2023-39343MEDIUMSulu Observable Response Discrepancy on Admin LoginEPSS 0.6%CVE-2023-3336MEDIUMTN-5900 Series User Enumeration VulnerabilityEPSS 0.6%CVE-2023-3221MEDIUMUser enumeration vulnerability in Roundcube Password Recovery PluginEPSS 0.6%CVE-2026-28358LOWNocoDB: User Enumeration via Password Reset EndpointEPSS 0.6%CVE-2022-39228MEDIUMObservable Response Discrepancy in vantage6EPSS 0.6%CVE-2024-25146MEDIUMLiferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and oEPSS 0.6%CVE-2026-69519HIGHAzure Stack HCI Information Disclosure VulnerabilityEPSS 0.6%CVE-2021-36201MEDIUMCCURE Observable Response DiscrepancyEPSS 0.6%