Weaknesses of type CWE-204

171 results

Vazamento de informações através de respostas diferenciadas

A aplicação retorna respostas diferentes (tempo de processamento, mensagens de erro, código HTTP, tamanho da resposta) dependendo do estado interno do sistema, permitindo que atacantes deduzam informações sensíveis sem autorização. Por exemplo, responder com 'usuário não encontrado' versus 'senha incorreta' vaza a existência de contas.

Example

Um formulário de login que retorna 'usuário inexistente' para um email não cadastrado, mas 'credenciais inválidas' quando o email existe, permite que invasores enumerem contas válidas da plataforma sem precisar quebrar senhas.

How to mitigate

Padronize todas as respostas de erro (mensagens e tempo de processamento) para cenários de falha similares. Use mensagens genéricas como 'credenciais inválidas' independente do motivo real, e implemente rate limiting para dificultar enumeração automatizada.

CVE-2022-41697MEDIUMA user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can leaEPSS 20.2%CVE-2016-9499—The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.EPSS 7.8%CVE-2019-19030MEDIUMCloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reEPSS 1.9%CVE-2022-0564MEDIUMQlik Sense Enterprise Domain User enumerationEPSS 1.4%CVE-2021-20049—A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration baseEPSS 1.3%CVE-2021-39189MEDIUMObservable Response Discrepancy in Lost Password ServiceEPSS 1.3%CVE-2020-11063LOWObservable Response Discrepancy in TYPO3 CMSEPSS 1.2%CVE-2024-39211MEDIUMKaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_emaiEPSS 1.1%CVE-2021-34580HIGHRemote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0EPSS 1.0%CVE-2022-31248MEDIUMSUMA user enumeration via weak error messageEPSS 1.0%CVE-2025-34254MEDIUMD-Link Nuclias Connect <= v1.3.1.4 Login Account EnumerationEPSS 1.0%CVE-2025-34255MEDIUMD-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account EnumerationEPSS 1.0%CVE-2022-22520MEDIUMUser enumeration vulnerability in MB connect line and Helmholz productsEPSS 0.8%CVE-2024-2482LOWSurya2Developer Hostel Management Service HTTP POST Request check_availability.php observable response discrepancyEPSS 0.8%CVE-2023-23449MEDIUMObservable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 EPSS 0.8%CVE-2023-35698MEDIUMObservable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the rEPSS 0.8%CVE-2025-62512MEDIUMPiwigo Vulnerable to User Enumeration via Password Reset EndpointEPSS 0.8%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%CVE-2024-13028MEDIUMAntabot White-Jotter login observable response discrepancyEPSS 0.7%CVE-2022-1989MEDIUMCODESYS Visualization vulnerable to user enumerationEPSS 0.7%