Falhas do tipo CWE-204

210 resultados

Vazamento de informações por respostas diferenciadas

A aplicação retorna respostas diferentes (tempo de resposta, mensagens de erro, códigos HTTP, comportamento) para requisições distintas, permitindo que um atacante deduza informações internas (existência de usuários, estrutura do sistema, dados sensíveis) sem ter acesso autorizado. O risco está em cada diferença na resposta servir como pista que reduz o espaço de busca do ataque.

Exemplo

Um endpoint de login retorna 'usuário não encontrado' para emails inexistentes, mas 'senha incorreta' para emails válidos. Um atacante usa isso para enumerar contas ativas no sistema. Ou um sistema que demora 200ms para validar senhas corretas e 50ms para incorretas, permitindo adivinhação via timing.

Como mitigar

Padronize respostas para casos de erro (mesmo tempo, mesma mensagem genérica) e implemente rate limiting em operações sensíveis. Use bcrypt com custo fixo para autenticação e evite diferenciar comportamento baseado em dados internos não-públicos.

CVE-2023-27283MEDIUMIBM Aspera Orchestrator information disclosureEPSS 0.5%CVE-2023-38362MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2025-3092HIGHMB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24EPSS 0.5%CVE-2021-20556MEDIUMIBM Cognos Controller information disclosureEPSS 0.5%CVE-2026-84307LOWFilament: Password validity disclosure for accounts denied panel access on login pageEPSS 0.5%CVE-2023-27464MEDIUMA vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix EPSS 0.5%CVE-2023-4095MEDIUMUser enumeration vulnerability in Fujitsu Arconte ÁureaEPSS 0.5%CVE-2026-33419CRITICALMinIO: LDAP login brute-force via user enumeration and missing rate limitEPSS 0.5%CVE-2025-40806MEDIUMA vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeratioEPSS 0.5%CVE-2024-55198MEDIUMUser Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allowEPSS 0.5%CVE-2024-28868LOWUmbraco possible user enumeration vulnerabilityEPSS 0.5%CVE-2025-24342MEDIUMA vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernaEPSS 0.5%CVE-2023-46170MEDIUMIBM DS8900F information disclosureEPSS 0.5%CVE-2023-40179MEDIUMSilverware Games vulnerable to account enumeration via inconsistent responsesEPSS 0.4%CVE-2023-31186MEDIUMAvaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response DiscrepancyEPSS 0.4%CVE-2023-37217MEDIUM Tadiran Telecom Aeonix - CWE-204: Observable Response DiscrepancyEPSS 0.4%CVE-2026-54768MEDIUMWPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)EPSS 0.4%CVE-2025-62181MEDIUMPega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.EPSS 0.4%CVE-2024-12663MEDIUMfunnyzpc Mee-Admin Login login observable response discrepancyEPSS 0.4%CVE-2023-49069MEDIUMA vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by theEPSS 0.4%