CWE-203 通过差异性导致的信息暴露 类弱点 179 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-203 属于可观察差异漏洞，指产品在不同情境下表现出可被未授权方察觉的差异行为或响应。攻击者常利用此特性进行侧信道分析，通过对比响应时间、错误信息或状态码，推断系统内部逻辑、验证用户身份或探测敏感数据。开发者应避免暴露细微差异，确保对合法与非法请求返回一致的错误提示和响应格式，并统一处理逻辑，从而消除可用于信息泄露的观测线索。
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }"Login Failed - incorrect username or password"def validate_password(actual_pw, typed_pw): if len(actual_pw) <> len(typed_pw): return 0 for i in len(actual_pw): if actual_pw[i] <> typed_pw[i]: return 0 return 1| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-36105 | TYPO3 安全漏洞 — typo3 | 5.3 | Medium | 2022-09-13 |
| CVE-2022-20866 | Cisco Firepower Threat Defense 和Cisco Adaptive Security Appliances Software 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 7.4 | High | 2022-08-10 |
| CVE-2022-27221 | Siemens SINEMA Remote Connect Server 安全特征问题漏洞 — SINEMA Remote Connect Server | 5.9 | Medium | 2022-06-14 |
| CVE-2022-0823 | Zyxel GS1200 安全漏洞 — Zyxel GS1200 series firmware | 6.2 | Medium | 2022-06-07 |
| CVE-2022-24043 | 多款Siemens产品安全漏洞 — Desigo DXR2 | 5.3 | - | 2022-05-10 |
| CVE-2021-33845 | Splunk Enterprise 安全漏洞 — Splunk Enterprise | 5.3 | Medium | 2022-05-06 |
| CVE-2022-0569 | Snipe-IT 信息泄露漏洞 — snipe/snipe-it | 5.3 | Medium | 2022-02-12 |
| CVE-2022-22120 | NocoDB 安全漏洞 — nocodb | 5.3 | Medium | 2022-01-10 |
| CVE-2021-38153 | Apache Kafka 安全漏洞 — Apache Kafka | 5.9 | - | 2021-09-22 |
| CVE-2021-34576 | Kaden PICOFLUX Air 安全漏洞 — PICOFLUX AiR | 4.3 | Medium | 2021-09-16 |
| CVE-2021-3642 | Red Hat Wildfly Elytron 安全漏洞 — wildfly-elytron | 7.5 | - | 2021-08-05 |
| CVE-2021-34575 | MB connect line 多款产品 信息泄露漏洞 — mymbCONNECT24 | 7.5 | High | 2021-08-02 |
| CVE-2021-29621 | Flask-AppBuilder安全漏洞 — Flask-AppBuilder | 5.3 | Medium | 2021-06-07 |
| CVE-2021-1486 | Cisco SD-WAN vManage 安全漏洞 — Cisco SD-WAN vManage | 5.3 | Medium | 2021-05-06 |
| CVE-2021-29446 | jose-node-cjs-runtime 安全漏洞 — jose-node-cjs-runtime | 5.9 | Medium | 2021-04-16 |
| CVE-2021-29445 | jose-node-esm-runtime 安全漏洞 — jose-node-esm-runtime | 5.9 | Medium | 2021-04-16 |
| CVE-2021-29444 | jose-browser-runtime 安全漏洞 — jose | 5.9 | Medium | 2021-04-16 |
| CVE-2021-29443 | jose 安全漏洞 — jose | 5.9 | Medium | 2021-04-16 |
| CVE-2020-3585 | Cisco Firepower Threat Defense和Cisco Adaptive Security Appliances Software 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 5.3 | Medium | 2020-10-21 |
| CVE-2020-1685 | Juniper Networks Junos OS EX和Junos OS EX/QFX 安全漏洞 — Junos OS | 5.8 | Medium | 2020-10-16 |
| CVE-2020-5143 | SonicWall SonicOS SSLVPN NACagent 安全漏洞 — SonicOS | 5.3 | - | 2020-10-12 |
| CVE-2020-15151 | OpenMage LTS 跨站请求伪造漏洞 — magento-lts | 8.0 | High | 2020-08-19 |
| CVE-2018-16868 | GnuTLS 加密问题漏洞 — gnutls | 4.6 | - | 2018-12-03 |
| CVE-2018-16869 | Nettle 加密问题漏洞 — nettle | 5.7 | - | 2018-12-03 |
| CVE-2018-14597 | CA Technologies Identity Governance和Identity Suite Virtual Appliance 安全漏洞 — CA Identity Governance | 5.3 | - | 2018-10-17 |
| CVE-2018-10919 | Samba 信息泄露漏洞 — samba | 6.5 | - | 2018-08-22 |
| CVE-2017-13098 | Legion of the Bouncy Castle TLS 加密问题漏洞 — BouncyCastle TLS | 5.9 | - | 2017-12-13 |
| CVE-2017-13099 | wolfSSL 安全漏洞 — wolfSSL | 5.9 | - | 2017-12-13 |
| CVE-2016-9129 | Revive Adserver 信息泄露漏洞 — Revive Adserver All versions before 3.2.3 | 5.3 | - | 2017-03-28 |
CWE-203（通过差异性导致的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 179 条 CVE 漏洞。