Weaknesses of type CWE-204

191 results

Vazamento de informações através de respostas diferenciadas

A aplicação retorna respostas diferentes (tempo de processamento, mensagens de erro, código HTTP, tamanho da resposta) dependendo do estado interno do sistema, permitindo que atacantes deduzam informações sensíveis sem autorização. Por exemplo, responder com 'usuário não encontrado' versus 'senha incorreta' vaza a existência de contas.

Example

Um formulário de login que retorna 'usuário inexistente' para um email não cadastrado, mas 'credenciais inválidas' quando o email existe, permite que invasores enumerem contas válidas da plataforma sem precisar quebrar senhas.

How to mitigate

Padronize todas as respostas de erro (mensagens e tempo de processamento) para cenários de falha similares. Use mensagens genéricas como 'credenciais inválidas' independente do motivo real, e implemente rate limiting para dificultar enumeração automatizada.

CVE-2025-25236MEDIUMOmnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive inEPSS 0.2%CVE-2025-59116MEDIUMUser enumeration in Windu CMSEPSS 0.2%CVE-2026-39851MEDIUMSaleor has a user enumeration vulnerability due to different error messagesEPSS 0.2%CVE-2026-31901MEDIUMParse Server has user enumeration via email verification endpointEPSS 0.2%CVE-2025-13460MEDIUMIBM Aspera Console Information DisclosureEPSS 0.2%CVE-2026-86758HIGHSnipe-IT before 8.7.0 License Key Exposure via CSV ExportEPSS 0.2%CVE-2026-24097MEDIUMAuthenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing EndpointEPSS 0.2%CVE-2026-75575MEDIUMRocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor MethodEPSS 0.2%CVE-2026-78584MEDIUMObservable Response Discrepancy in Kibana Leading to Cross-Space Information DisclosureEPSS 0.2%CVE-2025-67500LOWMastodon Error Handling Discrepancy Enables Private Status Existence EnumerationEPSS 0.2%CVE-2026-31888MEDIUMShopware has user enumeration via distinct error codes on Store API login endpointEPSS 0.2%CVE-2026-43926MEDIUMFOSSBilling's password reset confirmation endpoint lacks rate limitingEPSS 0.2%CVE-2026-45294MEDIUMFreeScout: User Account Enumeration via Password Reset Response DifferentiationEPSS 0.2%CVE-2026-44306MEDIUMStatamic: Email enumeration via forgot password endpointEPSS 0.2%CVE-2026-30876MEDIUMChamilo LMS: User enumeration vulnerability via responseEPSS 0.2%CVE-2026-55998MEDIUMCluster Existence Oracle via Unauthenticated Import EndpointEPSS 0.2%CVE-2026-9161MEDIUMUser Enumeration in DernekPlus' Website TemplateEPSS 0.2%CVE-2026-14202MEDIUMUsername Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.2%CVE-2026-45620MEDIUMAVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumerationEPSS 0.2%CVE-2023-50306MEDIUMIBM Common Licensing information disclosureEPSS 0.2%