Common Weakness Enumeration
CWE-203
AllowedObservable Discrepancy
Abstraction: Base · Status: Incomplete
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
886 vulnerabilities reference this CWE, most recent first.
GHSA-C7VV-QR7X-G477
Vulnerability from github – Published: 2022-04-29 03:01 – Updated: 2022-04-29 03:01
VLAI
Details
The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain information about the system and construct specialized attacks.
{
"affected": [],
"aliases": [
"CVE-2004-2252"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-12-31T05:00:00Z",
"severity": "MODERATE"
},
"details": "The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain information about the system and construct specialized attacks.",
"id": "GHSA-c7vv-qr7x-g477",
"modified": "2022-04-29T03:01:05Z",
"published": "2022-04-29T03:01:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-2252"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17960"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/13089"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1012065"
},
{
"type": "WEB",
"url": "http://www.astaro.org/showflat.php?Cat=\u0026Number=51459\u0026page=0\u0026view=collapsed\u0026sb=5\u0026o=\u0026fpart=1#51459"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/11407"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CF4Q-V7MM-G53Q
Vulnerability from github – Published: 2024-09-03 21:31 – Updated: 2024-09-12 21:32
VLAI
Details
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.
Severity
4.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-45678"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-03T20:15:08Z",
"severity": "MODERATE"
},
"details": "Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.",
"id": "GHSA-cf4q-v7mm-g53q",
"modified": "2024-09-12T21:32:01Z",
"published": "2024-09-03T21:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45678"
},
{
"type": "WEB",
"url": "https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=41434500"
},
{
"type": "WEB",
"url": "https://ninjalab.io/eucleak"
},
{
"type": "WEB",
"url": "https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf"
},
{
"type": "WEB",
"url": "https://support.yubico.com/hc/en-us/articles/15705749884444"
},
{
"type": "WEB",
"url": "https://www.yubico.com/support/security-advisories/ysa-2024-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CG5M-P8PG-93CG
Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2025-03-27 12:30
VLAI
Details
Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the !== used for comparison.
The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-0436"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-764"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T16:27:50Z",
"severity": "HIGH"
},
"details": "Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison.\n\nThe risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute",
"id": "GHSA-cg5m-p8pg-93cg",
"modified": "2025-03-27T12:30:34Z",
"published": "2024-02-26T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0436"
},
{
"type": "WEB",
"url": "https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJ89-CWCX-M929
Vulnerability from github – Published: 2022-11-21 09:30 – Updated: 2022-11-30 15:30
VLAI
Details
A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-4087"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-21T07:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.",
"id": "GHSA-cj89-cwcx-m929",
"modified": "2022-11-30T15:30:26Z",
"published": "2022-11-21T09:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4087"
},
{
"type": "WEB",
"url": "https://github.com/ipxe/ipxe/commit/186306d6199096b7a7c4b4574d4be8cdb8426729"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.214054"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJP5-P4X3-X7JG
Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2024-01-04 03:30
VLAI
Details
An information disclosure vulnerability exists on ARM implementations that use speculative execution in control flow via a side-channel analysis, aka "straight-line speculation, aka 'Windows ARM Information Disclosure Vulnerability'.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2020-1459"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-17T19:15:00Z",
"severity": "LOW"
},
"details": "An information disclosure vulnerability exists on ARM implementations that use speculative execution in control flow via a side-channel analysis, aka \u0026quot;straight-line speculation, aka \u0027Windows ARM Information Disclosure Vulnerability\u0027.",
"id": "GHSA-cjp5-p4x3-x7jg",
"modified": "2024-01-04T03:30:32Z",
"published": "2022-05-24T17:25:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1459"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1459"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CM2Q-67XF-JW8C
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2026-08-19 15:31
VLAI
Details
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
Severity
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-12401"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-08T14:15:00Z",
"severity": "MODERATE"
},
"details": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox \u003c 80 and Firefox for Android \u003c 80.",
"id": "GHSA-cm2q-67xf-jw8c",
"modified": "2026-08-19T15:31:50Z",
"published": "2022-05-24T17:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12401"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-36"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-39"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CMHJ-3C3R-RHFX
Vulnerability from github – Published: 2025-12-02 15:30 – Updated: 2026-08-26 18:30
VLAI
Details
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2025-59702"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-02T15:15:55Z",
"severity": "HIGH"
},
"details": "Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components.",
"id": "GHSA-cmhj-3c3r-rhfx",
"modified": "2026-08-26T18:30:28Z",
"published": "2025-12-02T15:30:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59702"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-cmhj-3c3r-rhfx"
},
{
"type": "WEB",
"url": "https://www.entrust.com/knowledgebase/hardware/understanding-nshield-security-advisory-september-2025"
},
{
"type": "WEB",
"url": "https://www.entrust.com/use-case/why-use-an-hsm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CP2F-VM9G-5GQR
Vulnerability from github – Published: 2025-05-22 18:31 – Updated: 2025-05-22 18:31
VLAI
{
"affected": [],
"aliases": [
"CVE-2025-23182"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-22T16:15:53Z",
"severity": "MODERATE"
},
"details": "CWE-203: Observable Discrepancy",
"id": "GHSA-cp2f-vm9g-5gqr",
"modified": "2025-05-22T18:31:15Z",
"published": "2025-05-22T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23182"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CPH6-524F-3HGR
Vulnerability from github – Published: 2025-11-13 23:07 – Updated: 2025-11-15 03:15
VLAI
Summary
Directus Vulnerable to Information Leakage in Existing Collections
Details
Summary:
An observable difference in error messaging was found in the Directus REST API. The /items/{collection} API returns different error messages for these two cases:
1. A user tries to access an existing collection which they are not authorized to access.
2. A user tries to access a non-existing collection.
The two differing error messages leak the existence of collections to users which are not authorized to access these collections.
Details:
The following response returns an error message, when requesting a collection the user is not authorized to access.
GET /items/no-access
{
"errors": [
{
"message": "You don't have permission to access collection \"no-access\" or it does not exist. Queried in root.",
"extensions": {
"reason": "You don't have permission to access collection \"no-access\" or it does not exist. Queried in root.",
"code": "FORBIDDEN"
}
}
]
}
The following response returns a different error message when requesting a collection which does not exist.
GET /items/does-not-exist
{
"errors": [
{
"message": "You don't have permission to access this.",
"extensions": {
"code": "FORBIDDEN"
}
}
]
}
Impact:
The difference in errors between non-existent collections and collections blocked by permissions leak the existence of a collection to a user which is not authorized to access this object.
Credit:
Sebastian Krause - Hackmanit GmbH
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.13.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "32.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64749"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-13T23:07:31Z",
"nvd_published_at": "2025-11-13T22:15:52Z",
"severity": "MODERATE"
},
"details": "### Summary:\n\nAn observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases:\n1. A user tries to access an existing collection which they are not authorized to access.\n2. A user tries to access a non-existing collection.\n\nThe two differing error messages leak the existence of collections to users which are not authorized to access these collections.\n\n### Details:\n\nThe following response returns an error message, when requesting a collection the user is not authorized to access.\n\n```\nGET /items/no-access\n{\n \"errors\": [\n {\n \"message\": \"You don\u0027t have permission to access collection \\\"no-access\\\" or it does not exist. Queried in root.\",\n \"extensions\": {\n \"reason\": \"You don\u0027t have permission to access collection \\\"no-access\\\" or it does not exist. Queried in root.\",\n \"code\": \"FORBIDDEN\"\n }\n }\n ]\n}\n```\n\nThe following response returns a different error message when requesting a collection which does not exist.\n\n```\nGET /items/does-not-exist\n{\n \"errors\": [\n {\n \"message\": \"You don\u0027t have permission to access this.\",\n \"extensions\": {\n \"code\": \"FORBIDDEN\"\n }\n }\n ]\n}\n```\n\n### Impact:\n\nThe difference in errors between non-existent collections and collections blocked by permissions leak the existence of a collection to a user which is not authorized to access this object.\n\n### Credit:\n\nSebastian Krause - [Hackmanit GmbH](https://hackmanit.de)",
"id": "GHSA-cph6-524f-3hgr",
"modified": "2025-11-15T03:15:40Z",
"published": "2025-11-13T23:07:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64749"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Directus Vulnerable to Information Leakage in Existing Collections"
}
GHSA-CPPP-J42J-CVVH
Vulnerability from github – Published: 2023-08-21 18:31 – Updated: 2024-04-04 07:05
VLAI
Details
The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-3604"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-21T17:15:49Z",
"severity": "HIGH"
},
"details": "The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.",
"id": "GHSA-cppp-j42j-cvvh",
"modified": "2024-04-04T07:05:05Z",
"published": "2023-08-21T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3604"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/8f6615e8-f607-4ce4-a0e0-d5fc841ead16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-46
Architecture and Design
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
Implementation
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-189: Black Box Reverse Engineering
An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds.