Weaknesses of type CWE-208

161 results

Discrepância de Tempo Observável

É quando o tempo de execução de uma operação varia dependendo do input (ex: senha, token, chave criptográfica), e essa variação é observável por um atacante. O código "vaza" informação sensível através do timing, permitindo descobrir dados sem acesso direto a eles.

Example

Uma função de validação de senha que compara caractere por caractere e retorna no primeiro erro: comparar 'abc123' (erro rápido no 1º char) vs 'abcdef' (erro mais lento no 5º char) revela ao atacante qual início de senha está correto, possibilitando brute force muito mais eficiente.

How to mitigate

Use comparações de tempo constante (constant-time comparison) para operações sensíveis, independente do resultado: bibliotecas como `hmac.compare()` em Node.js ou `secrets.compare()` em Python. Para autenticação, sempre complete o fluxo de validação antes de retornar qualquer resultado.

CVE-2022-29185MEDIUMObservable Timing Discrepancy in totp-rsEPSS 0.8%CVE-2024-54772MEDIUMAn issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.1EPSS 0.8%CVE-2025-13473MEDIUMUsername enumeration through timing difference in mod_wsgi authentication handlerEPSS 0.7%CVE-2014-125055LOWagnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancyEPSS 0.7%CVE-2014-125056LOWPylons horus services.py timing discrepancyEPSS 0.7%CVE-2021-4294LOWOpenShift OSIN CheckClientSecret timing discrepancyEPSS 0.7%CVE-2026-8794MEDIUMPaperCut NG/MF: User enumeration via timing attackEPSS 0.7%CVE-2013-10006LOWZiftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancyEPSS 0.7%CVE-2022-39308MEDIUMGoCD API authentication of user access tokens subject to timing attack during comparisonEPSS 0.7%CVE-2023-40021MEDIUMTiming Attack Reveals CSRF Tokens in oppiaEPSS 0.6%CVE-2023-1538MEDIUMObservable Timing Discrepancy in answerdev/answerEPSS 0.6%CVE-2022-4823LOWInSTEDD Nuntium geopoll_controller.rb timing discrepancyEPSS 0.6%CVE-2021-42016HIGHA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUEPSS 0.6%CVE-2016-15015LOWviafintech Barzahlen Payment Module PHP SDK Webhook.php verify timing discrepancyEPSS 0.6%CVE-2024-42368MEDIUMopen-telemetry has an Observable Timing DiscrepancyEPSS 0.6%CVE-2021-26314—AMD Speculative execution with Floating-Point Value InjectionEPSS 0.6%CVE-2024-42512HIGHVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenEPSS 0.6%CVE-2026-33006MEDIUMApache HTTP Server: mod_auth_digest timing attackEPSS 0.6%CVE-2024-45052MEDIUMFides Webserver Authentication Timing-Based Username Enumeration VulnerabilityEPSS 0.6%CVE-2026-47784HIGHIn memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslEPSS 0.5%