189 vulnerabilities classified as CWE-204 (响应差异性信息暴露). AI Chinese analysis included.
CWE-204, Observable Response Discrepancy, is a design weakness where software systems provide inconsistent or distinct feedback based on internal states, inadvertently leaking sensitive information to unauthorized external actors. Attackers typically exploit this by analyzing variations in response times, error messages, or status codes to infer the existence of specific users, valid input formats, or underlying system configurations. For instance, a login system might return a generic error for invalid usernames but a specific message for invalid passwords, allowing attackers to enumerate valid accounts. To mitigate this risk, developers must ensure uniform response behaviors regardless of the specific internal failure or state. This involves standardizing error messages, normalizing response times, and implementing consistent logging practices that do not expose granular details about the application’s internal logic or data validity to the end user.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }"Login Failed - incorrect username or password"| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2022-1989 | CODESYS Visualization vulnerable to user enumeration — CODESYS Visualization | 5.3 | Medium | 2022-08-23 |
| CVE-2022-31248 | SUMA user enumeration via weak error message — SUSE Manager Server 4.1 | 5.3 | Medium | 2022-06-22 |
| CVE-2022-0564 | Qlik Sense Enterprise Domain User enumeration — Qlik Sense Enterprise on Windows | 5.3 | Medium | 2022-02-21 |
| CVE-2021-20049 | Sonicwall SMA100 信息泄露漏洞 — SonicWall SMA100 | 7.5 | - | 2021-12-23 |
| CVE-2021-34580 | Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0 — mymbCONNECT24 | 7.5 | High | 2021-10-27 |
| CVE-2021-38476 | InHand Networks IR615 Router — IR615 Router | 6.5 | Medium | 2021-10-19 |
| CVE-2021-39189 | Observable Response Discrepancy in Lost Password Service — pimcore | 5.3 | Medium | 2021-09-15 |
| CVE-2020-11063 | Observable Response Discrepancy in TYPO3 CMS — TYPO3 CMS | 3.7 | Low | 2020-05-13 |
| CVE-2016-9499 | The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting. — FTP Server | 5.3 | - | 2018-07-13 |
Vulnerabilities classified as CWE-204 (响应差异性信息暴露) represent 189 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.