CWE-203
AllowedObservable Discrepancy
Abstraction: Base · Status: Incomplete
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
836 vulnerabilities reference this CWE, most recent first.
GHSA-HRQR-HXPP-CHR3
Vulnerability from github – Published: 2019-12-18 19:01 – Updated: 2025-02-13 18:33There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.
The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
Impact
The session id stored in a cookie is the same id that is used when querying the backing session storage engine. Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id. By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.
Releases
The 1.6.12 and 2.0.8 releases are available at the normal locations.
Workarounds
There are no known workarounds.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 1-6-session-timing-attack.patch - Patch for 1.6 series
- 2-0-session-timing-attack.patch - Patch for 2.6 series
Credits
Thanks Will Leinweber for reporting this!
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "rack"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-16782"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2019-12-18T19:01:07Z",
"nvd_published_at": "2019-12-18T20:15:00Z",
"severity": "MODERATE"
},
"details": "There\u0027s a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.\n\nThe session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.\n\n### Impact\n\nThe session id stored in a cookie is the same id that is used when querying the backing session storage engine. Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id. By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.\n\n## Releases\n\nThe 1.6.12 and 2.0.8 releases are available at the normal locations.\n\n### Workarounds\n\nThere are no known workarounds.\n\n### Patches\n\nTo aid users who aren\u0027t able to upgrade immediately we have provided patches for\nthe two supported release series. They are in git-am format and consist of a\nsingle changeset.\n\n* 1-6-session-timing-attack.patch - Patch for 1.6 series\n* 2-0-session-timing-attack.patch - Patch for 2.6 series\n\n### Credits\n\nThanks Will Leinweber for reporting this!",
"id": "GHSA-hrqr-hxpp-chr3",
"modified": "2025-02-13T18:33:17Z",
"published": "2019-12-18T19:01:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16782"
},
{
"type": "WEB",
"url": "https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38"
},
{
"type": "PACKAGE",
"url": "https://github.com/rack/rack"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2019-16782.yml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZXMWILCICQLA2BYSP6I2CRMUG53YBLX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZXMWILCICQLA2BYSP6I2CRMUG53YBLX"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/12/18/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/12/18/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/12/19/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/04/08/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/04/09/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Possible Information Leak / Session Hijack Vulnerability in Rack"
}
GHSA-HRXR-54XQ-7FMJ
Vulnerability from github – Published: 2022-04-29 03:00 – Updated: 2024-02-13 21:30Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
{
"affected": [],
"aliases": [
"CVE-2004-2150"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-12-31T05:00:00Z",
"severity": "MODERATE"
},
"details": "Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.",
"id": "GHSA-hrxr-54xq-7fmj",
"modified": "2024-02-13T21:30:19Z",
"published": "2022-04-29T03:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-2150"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17510"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/12661"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1011425"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/10349"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/11257"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HVC5-C94F-JG73
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11NVIDIA camera firmware contains a multistep, timing-related vulnerability where an unauthorized modification by camera resources may result in loss of data integrity or denial of service across several streams.
{
"affected": [],
"aliases": [
"CVE-2021-1109"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-11T22:15:00Z",
"severity": "MODERATE"
},
"details": "NVIDIA camera firmware contains a multistep, timing-related vulnerability where an unauthorized modification by camera resources may result in loss of data integrity or denial of service across several streams.",
"id": "GHSA-hvc5-c94f-jg73",
"modified": "2022-05-24T19:11:02Z",
"published": "2022-05-24T19:11:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1109"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5216"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HWP7-WR93-75M3
Vulnerability from github – Published: 2022-12-21 00:30 – Updated: 2022-12-21 00:30In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-219739967
{
"affected": [],
"aliases": [
"CVE-2022-20559"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T16:15:00Z",
"severity": "LOW"
},
"details": "In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-219739967",
"id": "GHSA-hwp7-wr93-75m3",
"modified": "2022-12-21T00:30:29Z",
"published": "2022-12-21T00:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20559"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HXM4-2WFQ-FQ5Q
Vulnerability from github – Published: 2023-05-20 15:30 – Updated: 2024-04-04 04:15The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.
{
"affected": [],
"aliases": [
"CVE-2023-1696"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-20T15:15:08Z",
"severity": "HIGH"
},
"details": "The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.",
"id": "GHSA-hxm4-2wfq-fq5q",
"modified": "2024-04-04T04:15:43Z",
"published": "2023-05-20T15:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1696"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2023/4"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-0000001506528486"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J225-CVW7-QRX7
Vulnerability from github – Published: 2024-01-05 06:30 – Updated: 2024-10-21 20:52PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pycryptodomex"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.19.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pycryptodome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.19.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-52323"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-05T17:25:46Z",
"nvd_published_at": "2024-01-05T04:15:07Z",
"severity": "HIGH"
},
"details": "PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.",
"id": "GHSA-j225-cvw7-qrx7",
"modified": "2024-10-21T20:52:14Z",
"published": "2024-01-05T06:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52323"
},
{
"type": "WEB",
"url": "https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd"
},
{
"type": "PACKAGE",
"url": "https://github.com/Legrandin/pycryptodome"
},
{
"type": "WEB",
"url": "https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/pycryptodomex/#history"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption"
}
GHSA-J229-WFR9-8X24
Vulnerability from github – Published: 2023-07-06 21:15 – Updated: 2025-01-17 18:31The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users.
{
"affected": [],
"aliases": [
"CVE-2023-28015"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-23T22:15:09Z",
"severity": "MODERATE"
},
"details": "The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. \u00a0 During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. \u00a0The attacker could use this information to focus a brute force attack on valid users.\n",
"id": "GHSA-j229-wfr9-8x24",
"modified": "2025-01-17T18:31:11Z",
"published": "2023-07-06T21:15:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28015"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0105093"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J2R4-2CR6-H3R3
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2025-02-10 20:30Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.4-p2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.4.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/project-community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-9588"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-10T23:18:37Z",
"nvd_published_at": "2020-06-26T21:15:00Z",
"severity": "HIGH"
},
"details": "Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.",
"id": "GHSA-j2r4-2cr6-h3r3",
"modified": "2025-02-10T20:30:10Z",
"published": "2022-05-24T17:21:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9588"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb20-22.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Magento Signature verification bypass"
}
GHSA-J2W9-9V56-Q925
Vulnerability from github – Published: 2023-10-11 00:30 – Updated: 2024-04-04 08:33User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
{
"affected": [],
"aliases": [
"CVE-2023-36127"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-10T22:15:11Z",
"severity": "HIGH"
},
"details": "User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.",
"id": "GHSA-j2w9-9v56-q925",
"modified": "2024-04-04T08:33:07Z",
"published": "2023-10-11T00:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36127"
},
{
"type": "WEB",
"url": "https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4"
},
{
"type": "WEB",
"url": "https://medium.com/@bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J385-Q64G-XHXJ
Vulnerability from github – Published: 2022-01-04 00:00 – Updated: 2022-01-14 00:03ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.
{
"affected": [],
"aliases": [
"CVE-2021-20147"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-03T22:15:00Z",
"severity": "MODERATE"
},
"details": "ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.",
"id": "GHSA-j385-q64g-xhxj",
"modified": "2022-01-14T00:03:28Z",
"published": "2022-01-04T00:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20147"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2021-52"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-189: Black Box Reverse Engineering
An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds.