CWE-204
Overview
- CWE ID
- 204
- CWE Name
- Observable Response Discrepancy
- CWE Abstraction
- Base
- CWE structure
- Simple
- CWE Status
- Incomplete
Description
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
Extended Description
This issue frequently occurs during authentication, where a difference in failed-login messages could allow an attacker to determine if the username is valid or not. These exposures can be inadvertent (bug) or intentional (design).
Related CWEs
| CWE ID | View ID | Nature | Ordinal |
|---|---|---|---|
| 203 | 1000 | ChildOf | Primary |