Fallos del tipo CWE-204

215 resultados

Vazamento de informações por resposta diferenciada

A aplicação entrega respostas distintas (tempo de processamento, mensagens de erro, status HTTP, conteúdo) dependendo de estados internos ou dados sensíveis, permitindo que um atacante deduza informações que deveria estar ocultas. Por exemplo, responder "usuário não encontrado" em vez de "senha incorreta" revela quais contas existem no sistema.

Ejemplo

Um serviço de autenticação retorna erro diferente se a senha está errada ("Acesso negado") versus se o e-mail não existe no banco ("E-mail não registrado"). Um atacante lista e-mails válidos simplesmente testando combinações. Ou um endpoint que demora 500ms para usuários autenticados mas 50ms para tokens inválidos, vazando informações via timing.

Cómo mitigar

Padronize todas as respostas de erro relevantes (mesmo mensagem, mesmo código HTTP, mesmo tempo de processamento). Use respostas genéricas ("Credenciais inválidas" em vez de especificar o motivo) e implemente rate limiting para dificultar enumeração. Valide que dados sensíveis nunca vazam em headers, timing ou logs públicos.

CVE-2025-30280MEDIUMA vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), MendiEPSS 0.5%CVE-2023-27283MEDIUMIBM Aspera Orchestrator information disclosureEPSS 0.5%CVE-2025-3092HIGHMB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24EPSS 0.5%CVE-2021-20556MEDIUMIBM Cognos Controller information disclosureEPSS 0.5%CVE-2026-84307LOWFilament: Password validity disclosure for accounts denied panel access on login pageEPSS 0.5%CVE-2023-27464MEDIUMA vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix EPSS 0.5%CVE-2023-4095MEDIUMUser enumeration vulnerability in Fujitsu Arconte ÁureaEPSS 0.5%CVE-2025-40806MEDIUMA vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeratioEPSS 0.5%CVE-2026-33419CRITICALMinIO: LDAP login brute-force via user enumeration and missing rate limitEPSS 0.5%CVE-2024-55198MEDIUMUser Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allowEPSS 0.5%CVE-2024-28868LOWUmbraco possible user enumeration vulnerabilityEPSS 0.5%CVE-2025-24342MEDIUMA vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernaEPSS 0.5%CVE-2023-46170MEDIUMIBM DS8900F information disclosureEPSS 0.5%CVE-2023-40179MEDIUMSilverware Games vulnerable to account enumeration via inconsistent responsesEPSS 0.4%CVE-2023-31186MEDIUMAvaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response DiscrepancyEPSS 0.4%CVE-2023-37217MEDIUM Tadiran Telecom Aeonix - CWE-204: Observable Response DiscrepancyEPSS 0.4%CVE-2026-54768MEDIUMWPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)EPSS 0.4%CVE-2025-62181MEDIUMPega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.EPSS 0.4%CVE-2026-100362MEDIUMSuiteCRM: V8 OAuth2 Username EnumerationEPSS 0.4%CVE-2024-12663MEDIUMfunnyzpc Mee-Admin Login login observable response discrepancyEPSS 0.4%