Weaknesses of type CWE-204

191 results

Vazamento de informações através de respostas diferenciadas

A aplicação retorna respostas diferentes (tempo de processamento, mensagens de erro, código HTTP, tamanho da resposta) dependendo do estado interno do sistema, permitindo que atacantes deduzam informações sensíveis sem autorização. Por exemplo, responder com 'usuário não encontrado' versus 'senha incorreta' vaza a existência de contas.

Example

Um formulário de login que retorna 'usuário inexistente' para um email não cadastrado, mas 'credenciais inválidas' quando o email existe, permite que invasores enumerem contas válidas da plataforma sem precisar quebrar senhas.

How to mitigate

Padronize todas as respostas de erro (mensagens e tempo de processamento) para cenários de falha similares. Use mensagens genéricas como 'credenciais inválidas' independente do motivo real, e implemente rate limiting para dificultar enumeração automatizada.

CVE-2025-46736MEDIUMUmbraco Makes User Enumeration Feasible Based on Timing of Login ResponseEPSS 0.4%CVE-2026-53908MEDIUMUser Enumeration in MCOEPSS 0.4%CVE-2023-33859MEDIUMIBM Security ReaQta information disclosureEPSS 0.4%CVE-2021-47717MEDIUMIntelliChoice eFORCE Software Suite Username EnumerationEPSS 0.4%CVE-2025-67874MEDIUMChurchCRM has plaintext password return in responseEPSS 0.4%CVE-2024-36996MEDIUMInformation Disclosure of user namesEPSS 0.4%CVE-2024-38431MEDIUMMatrix Tafnit v8 - CWE-204: Observable Response DiscrepancyEPSS 0.4%CVE-2025-23193MEDIUMInformation Disclosure vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.3%CVE-2026-44753LOWInformation Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)EPSS 0.3%CVE-2025-65899MEDIUMKalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error EPSS 0.3%CVE-2026-53947MEDIUMGhost: Member existence leak via magic link sign-in responseEPSS 0.3%CVE-2025-0163MEDIUMIBM Security Verify Access information disclosureEPSS 0.3%CVE-2026-54768MEDIUMWPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)EPSS 0.3%CVE-2025-42903MEDIUMUser Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims ManagementEPSS 0.3%CVE-2026-40485MEDIUMChurchCRM: Username Enumeration via Differential Response in Public Login APIEPSS 0.3%CVE-2024-23574MEDIUMHCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confEPSS 0.3%CVE-2024-42343MEDIUMLoway - CWE-204: Observable Response DiscrepancyEPSS 0.3%CVE-2026-25138MEDIUMRucio WebUI has Username Enumeration via Login Error MessageEPSS 0.3%CVE-2025-24023LOWObservable Response Discrepancy in flask-appbuilderEPSS 0.3%CVE-2026-33323MEDIUMParse Server: Email verification resend page leaks user existenceEPSS 0.3%