CWE-204 Observable Response Discrepancy
baseThe product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (246)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-7790US | critical9.8OT elevated | — | ||
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allow… | ||||
| CVE-2019-19030US | medium5.3 | Exploit | ||
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether… | ||||
| CVE-2022-23342US | medium5.3 | Exploit | ||
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An… | ||||
| CVE-2015-7902US | medium5.0 | Exploit | ||
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows r… | ||||
| CVE-2002-0212US | high7.5OT elevated | — | ||
The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existen… | ||||
| CVE-2026-14177US | high7.5 | — | ||
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.
This issue affects ikas E-Commerce Infrastructure… | ||||
| CVE-2026-19205US | high7.5 | — | ||
Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting.
This issue affects GastroMenum Web Panel: before 31.08.2026. | ||||
| CVE-2026-19080US | high7.5 | — | ||
Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting.
This issue affects Menulux Portal: before 20260903211448. | ||||
| CVE-2026-60007US | high7.4 | — | ||
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowi… | ||||
| CVE-2026-33419US | high7.5 | — | ||
MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnera… | ||||
| CVE-2025-12455US | high7.5 | — | ||
Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.
The vulnerability could lead to Password Brute Forcing in Vertica management con… | ||||
| CVE-2025-23193US | high7.5 | — | ||
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, po… | ||||
| CVE-2024-42343US | high7.5 | — | ||
Loway - CWE-204: Observable Response Discrepancy | ||||
| CVE-2024-38431US | high7.5 | — | ||
Matrix Tafnit v8
-
CWE-204: Observable Response Discrepancy | ||||
| CVE-2024-38322US | high7.5 | — | ||
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 2… | ||||
| CVE-2024-28232US | high7.5 | — | ||
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the lo… | ||||
| CVE-2024-24766US | high7.5 | — | ||
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumera… | ||||
| CVE-2021-20049US | high7.5 | — | ||
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerab… | ||||
| CVE-2021-34580US | high7.5 | — | ||
In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attemp… | ||||
| CVE-2022-41697US | medium5.3 | — | ||
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive informati… | ||||
03
attack patterns (4)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan