Falhas do tipo CWE-203

398 resultados

Discrepância Observável em Comportamento

Ocorre quando o sistema exibe comportamentos ou mensagens diferentes dependendo de informações secretas (senha, token, chave), permitindo que um atacante deduza essas informações através de análise de resposta. O perigo está em vazar conhecimento que deveria ser privado por meio de canais laterais, como tempo de resposta, mensagens de erro ou mudanças visuais.

Exemplo

Um formulário de login que retorna 'Usuário não existe' para usuários inválidos e 'Senha incorreta' para usuários válidos com senha errada. Um atacante usa essas mensagens diferentes para enumerar contas válidas sem nunca adivinhar a senha correta.

Como mitigar

Padronize respostas do sistema: retorne sempre a mesma mensagem genérica (ex: 'Credenciais inválidas') e o mesmo tempo de resposta, independentemente de qual parte falhou. Use técnicas como constant-time comparison para operações sensíveis e evite vazar informações através de timing, códigos HTTP diferenciados ou feedback textual discriminador.

CVE-2026-56319MEDIUMCapgo - App Existence Oracle via GET /statistics/app/:app_idEPSS 0.3%CVE-2026-63573HIGHBleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrapEPSS 0.3%CVE-2026-19134HIGHA vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering. This issue affects OpenText Directory EPSS 0.3%CVE-2025-13591MEDIUMUsername Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryEPSS 0.3%CVE-2024-45089MEDIUMIBM Sterling B2B Integrator information disclosureEPSS 0.3%CVE-2024-47869LOWNon-constant-time comparison when comparing hashes in GradioEPSS 0.3%CVE-2023-30312HIGHAn issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to EPSS 0.3%CVE-2026-14071MEDIUMSide-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%CVE-2026-121187MEDIUMObservable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafEPSS 0.3%CVE-2026-113057MEDIUMObservable discrepancy in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information EPSS 0.3%CVE-2026-8242MEDIUMIndustrial Application Software IAS Canias ERP Login RMI doAction response discrepancyEPSS 0.3%CVE-2024-55374MEDIUMREDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.EPSS 0.3%CVE-2025-23182MEDIUMUBtech – CWE-203: Observable DiscrepancyEPSS 0.3%CVE-2025-46720LOWKeystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fieldsEPSS 0.3%CVE-2025-43743MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.EPSS 0.3%CVE-2026-87518MEDIUMObservable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the rEPSS 0.3%CVE-2026-87566MEDIUMObservable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a craftEPSS 0.3%CVE-2026-23621MEDIUMGFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File EnumerationEPSS 0.3%CVE-2026-79028MEDIUMObservable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crEPSS 0.3%CVE-2026-79030MEDIUMObservable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a cEPSS 0.3%