CWE-203
AllowedObservable Discrepancy
Abstraction: Base · Status: Incomplete
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
884 vulnerabilities reference this CWE, most recent first.
GHSA-VHV4-76F8-WX8J
Vulnerability from github – Published: 2022-03-31 00:00 – Updated: 2022-04-06 00:01In DevicePolicyManager, there is a possible way to reveal the existence of an installed package without proper query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-204995407
{
"affected": [],
"aliases": [
"CVE-2021-39755"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-30T16:15:00Z",
"severity": "MODERATE"
},
"details": "In DevicePolicyManager, there is a possible way to reveal the existence of an installed package without proper query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-204995407",
"id": "GHSA-vhv4-76f8-wx8j",
"modified": "2022-04-06T00:01:53Z",
"published": "2022-03-31T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39755"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-12l"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VHVC-4F6P-XP27
Vulnerability from github – Published: 2025-12-10 21:31 – Updated: 2025-12-17 18:31SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server's error responses.
{
"affected": [],
"aliases": [
"CVE-2020-36888"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-10T21:16:01Z",
"severity": "MODERATE"
},
"details": "SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server\u0027s error responses.",
"id": "GHSA-vhvc-4f6p-xp27",
"modified": "2025-12-17T18:31:33Z",
"published": "2025-12-10T21:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36888"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/48847"
},
{
"type": "WEB",
"url": "https://www.spinetix.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/spinetix-fusion-digital-signage-username-enumeration-via-login-script"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5591.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VJ54-CJRX-X696
Vulnerability from github – Published: 2021-12-09 19:59 – Updated: 2023-09-29 17:24Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.
Specific Go Packages Affected
github.com/argoproj/argo-cd/util/session github.com/argoproj/argo-cd/server/session
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "1.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.5.0"
]
}
],
"aliases": [
"CVE-2020-11576"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-25T18:19:26Z",
"nvd_published_at": "2020-04-08T18:15:00Z",
"severity": "MODERATE"
},
"details": "Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.\n\n### Specific Go Packages Affected\ngithub.com/argoproj/argo-cd/util/session\ngithub.com/argoproj/argo-cd/server/session",
"id": "GHSA-vj54-cjrx-x696",
"modified": "2023-09-29T17:24:54Z",
"published": "2021-12-09T19:59:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11576"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/pull/3215"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1"
},
{
"type": "WEB",
"url": "https://www.soluble.ai/blog/argo-cves-2020"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Observable Discrepancy in Argo"
}
GHSA-VJ56-JG6H-3GPR
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.
{
"affected": [],
"aliases": [
"CVE-2021-26313"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T12:15:00Z",
"severity": "MODERATE"
},
"details": "Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.",
"id": "GHSA-vj56-jg6h-3gpr",
"modified": "2022-05-24T19:04:40Z",
"published": "2022-05-24T19:04:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26313"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4931"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/09/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/10/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/10/10"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/10/11"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-375.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VJ7G-5FJ3-RC83
Vulnerability from github – Published: 2024-03-14 03:31 – Updated: 2024-08-22 21:31User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint.
{
"affected": [],
"aliases": [
"CVE-2024-25651"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T03:15:08Z",
"severity": "MODERATE"
},
"details": "User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint.",
"id": "GHSA-vj7g-5fj3-rc83",
"modified": "2024-08-22T21:31:27Z",
"published": "2024-03-14T03:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25651"
},
{
"type": "WEB",
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25651"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VJ8V-34WR-VJM9
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.
{
"affected": [],
"aliases": [
"CVE-2021-38209"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-08T20:15:00Z",
"severity": "LOW"
},
"details": "net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.",
"id": "GHSA-vj8v-34wr-vjm9",
"modified": "2022-05-24T19:10:23Z",
"published": "2022-05-24T19:10:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38209"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6"
},
{
"type": "WEB",
"url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VJF7-9XRV-FJRQ
Vulnerability from github – Published: 2024-05-22 06:30 – Updated: 2024-05-22 06:30Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-35165"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T06:15:09Z",
"severity": "MODERATE"
},
"details": "Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.",
"id": "GHSA-vjf7-9xrv-fjrq",
"modified": "2024-05-22T06:30:38Z",
"published": "2024-05-22T06:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35165"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VM48-354F-2W7J
Vulnerability from github – Published: 2021-12-16 00:01 – Updated: 2021-12-18 00:01In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536547
{
"affected": [],
"aliases": [
"CVE-2021-0995"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-15T19:15:00Z",
"severity": "LOW"
},
"details": "In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536547",
"id": "GHSA-vm48-354f-2w7j",
"modified": "2021-12-18T00:01:20Z",
"published": "2021-12-16T00:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0995"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2021-12-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VMF9-6PCV-XR87
Vulnerability from github – Published: 2023-08-29 23:34 – Updated: 2026-07-31 22:35Withdrawn Advisory
This advisory has been withdrawn due to an incorrect package mapping error. This link is maintained to preserve external references.
Original Description
Summary
Using a recovery flow with an identification stage an attacker is able to determine if a username exists.
Impact
Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recovery flow described above is susceptible to having their username/email revealed as existing.
Details
An attacker can easily enumerate and check users' existence using the recovery flow, as a clear message is shown when a user doesn't exist. Depending on configuration this can either be done by username, email, or both.
The invalid and valid usernames should both show the same message and always send an email. Article for reference here: https://postmarkapp.com/guides/password-reset-email-best-practices#how-to-make-sure-your-password-reset-emails-are-secure
For more information
If you have any questions or comments about this advisory:
- Email us at security@goauthentik.io
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@goauthentik/api"
},
"ranges": [
{
"events": [
{
"introduced": "2023.6.0"
},
{
"fixed": "2023.6.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@goauthentik/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2023.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-39522"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-29T23:34:51Z",
"nvd_published_at": "2023-08-29T18:15:08Z",
"severity": "MODERATE"
},
"details": "### Withdrawn Advisory\nThis advisory has been withdrawn due to an incorrect package mapping error. This link is maintained to preserve external references.\n\n### Original Description\n## Summary\nUsing a recovery flow with an identification stage an attacker is able to determine if a username exists.\n\n## Impact\nOnly setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recovery flow described above is susceptible to having their username/email revealed as existing.\n\n## Details\n\nAn attacker can easily enumerate and check users\u0027 existence using the recovery flow, as a clear message is shown when a user doesn\u0027t exist. Depending on configuration this can either be done by username, email, or both.\n\nThe invalid and valid usernames should both show the same message and always send an email. Article for reference here: https://postmarkapp.com/guides/password-reset-email-best-practices#how-to-make-sure-your-password-reset-emails-are-secure\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Email us at [security@goauthentik.io](mailto:security@goauthentik.io)",
"id": "GHSA-vmf9-6pcv-xr87",
"modified": "2026-07-31T22:35:59Z",
"published": "2023-08-29T23:34:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-vmf9-6pcv-xr87"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39522"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/8720#pullrequestreview-4726968365"
},
{
"type": "WEB",
"url": "https://github.com/goauthentik/authentik/commit/aa874dd92a770d5f8cd8f265b7cdd31cd73a4599"
},
{
"type": "PACKAGE",
"url": "https://github.com/goauthentik/authentik"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Withdrawn Advisory: Username enumeration attack in goauthentik",
"withdrawn": "2026-07-31T22:35:59Z"
}
GHSA-VMVM-JJVW-QWPW
Vulnerability from github – Published: 2024-07-03 18:48 – Updated: 2024-07-03 18:48Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.
{
"affected": [],
"aliases": [
"CVE-2024-39830"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-03T09:15:07Z",
"severity": "HIGH"
},
"details": "Mattermost versions 9.8.x \u003c= 9.8.0, 9.7.x \u003c= 9.7.4, 9.6.x \u003c= 9.6.2 and 9.5.x \u003c= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.",
"id": "GHSA-vmvm-jjvw-qwpw",
"modified": "2024-07-03T18:48:12Z",
"published": "2024-07-03T18:48:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39830"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-189: Black Box Reverse Engineering
An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds.