CWE-204
AllowedObservable Response Discrepancy
Abstraction: Base · Status: Incomplete
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
326 vulnerabilities reference this CWE, most recent first.
GHSA-JFH6-W7R2-RJ74
Vulnerability from github – Published: 2026-08-25 03:32 – Updated: 2026-08-25 03:32Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.
{
"affected": [],
"aliases": [
"CVE-2026-75575"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T02:16:51Z",
"severity": "MODERATE"
},
"details": "Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment\u0027s own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.",
"id": "GHSA-jfh6-w7r2-rj74",
"modified": "2026-08-25T03:32:10Z",
"published": "2026-08-25T03:32:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7c6v-m68v-v73r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75575"
},
{
"type": "WEB",
"url": "https://github.com/RocketChat/Rocket.Chat/commit/3a61c3afe"
},
{
"type": "WEB",
"url": "https://github.com/RocketChat/Rocket.Chat"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/rocket-chat-missing-ddp-rate-limit-on-the-sendforgotpasswordemail-meteor-method"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JGC6-C9V8-VFQW
Vulnerability from github – Published: 2024-07-01 18:32 – Updated: 2024-07-01 18:32In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme.
{
"affected": [],
"aliases": [
"CVE-2024-36996"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T17:15:08Z",
"severity": "MODERATE"
},
"details": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme.",
"id": "GHSA-jgc6-c9v8-vfqw",
"modified": "2024-07-01T18:32:41Z",
"published": "2024-07-01T18:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36996"
},
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2024-0716"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JHH7-832H-F8HV
Vulnerability from github – Published: 2026-07-31 22:24 – Updated: 2026-07-31 22:24Summary
The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment:
// We obsfucate the actual success of this mutation to prevent user enumeration.
The mutation always returns success: true regardless of whether the supplied username/email belongs to an existing user. The intended public output field is only success: Boolean.
However, a deprecated user field is still registered on the SendPasswordResetEmailPayload output type in src/Deprecated.php (lines 433-450). This deprecated field resolves to a full User object when the supplied username/email corresponds to an existing author-class user, and null otherwise — completely undermining the anti-enumeration design.
The @todo remove in 3.0.0 comment acknowledges the field is scheduled for removal, but it remains active in all 2.x releases, including current 2.14.1.
Discovered via source code review on May 29, 2026.
Details
The mutation resolver in src/Mutation/SendPasswordResetEmail.php:
$payload = ['success' => true, 'id' => null];
$user_data = self::get_user_data($input['username']);
if (!$user_data) {
graphql_debug(...);
return $payload; // id stays null
}
// ...send email, then...
return ['id' => $user_data->ID, 'success' => true];
The intended public output field is only success. The id is internal-only state for downstream resolvers.
src/Deprecated.php registers an additional user field on the same payload type:
register_graphql_field(
'SendPasswordResetEmailPayload',
'user',
[
'type' => 'User',
'deprecationReason' => static function () { return __('This field will be removed...'); },
'resolve' => static function ($payload, $args, AppContext $context) {
return !empty($payload['id'])
? $context->get_loader('user')->load_deferred($payload['id'])
: null;
},
],
);
This field reads the internal $payload['id'] and resolves it through the standard user loader. The User Model's allowed_restricted_fields policy permits unauthenticated reads of public author fields (databaseId, name, firstName, lastName, slug, description, uri, url).
PoC
mutation EnumerateUser {
sendPasswordResetEmail(input: { username: "victim@example.com" }) {
success
user {
databaseId
name
firstName
lastName
slug
description
uri
}
}
}
Behavior:
- Non-existing user/email → data.sendPasswordResetEmail.user is null
- - Existing author-class user → data.sendPasswordResetEmail.user is a full User object with the listed fields populated
- - success always returns true, preserving the appearance of obfuscation — the deprecated user field is the leak
Impact
- Username/email enumeration: unauthenticated attacker can verify whether any username or email is registered, with no WPGraphQL-side rate limiting
-
- Profile disclosure for author-class users: for any user with published posts (including editors and administrators), the attacker obtains
databaseId,name,firstName,lastName,slug,description(user bio),uri— substantially more than mere existence
- Profile disclosure for author-class users: for any user with published posts (including editors and administrators), the attacker obtains
-
- Bypasses partial hardening: sites that disabled the REST API user endpoint, the user XML sitemap, and
?author=Nauthor redirects may still be vulnerable through this WPGraphQL path
- Bypasses partial hardening: sites that disabled the REST API user endpoint, the user XML sitemap, and
-
- Spearphishing setup: firstName/lastName/description for authors provides personalized phishing material
Recommended fix
Either remove the deprecated user field entirely (advance the existing @todo remove in 3.0.0) or change the resolver to always return null:
diff
'resolve' => static function ($payload, $args, AppContext $context) {
- return !empty($payload['id']) ? $context->get_loader('user')->load_deferred($payload['id']) : null;
- + // Always null — this deprecated field previously leaked user existence,
- + // undermining the anti-enumeration design of the sendPasswordResetEmail mutation.
- + return null;
- },
-
Defense in depth — change the mutation resolver itself to not populate $payload['id'] on real success:
diff
return [
- 'id' => $user_data->ID,
- + 'id' => null,
- 'success' => true,
- ];
-
Luke Granto — independent security researcher operating in good faith. Discovery via source code review of wp-graphql/wp-graphql v2.14.1, approximately 15 minutes from git clone to confirmed bug. No live exploitation against any third-party deployment.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wp-graphql/wp-graphql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54768"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T22:24:29Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nThe `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in `src/Mutation/SendPasswordResetEmail.php` states in a code comment:\n\n`// We obsfucate the actual success of this mutation to prevent user enumeration.`\n\nThe mutation always returns `success: true` regardless of whether the supplied username/email belongs to an existing user. The intended public output field is only `success: Boolean`.\n\nHowever, a deprecated `user` field is still registered on the `SendPasswordResetEmailPayload` output type in `src/Deprecated.php` (lines 433-450). This deprecated field resolves to a full `User` object when the supplied username/email corresponds to an existing author-class user, and `null` otherwise \u2014 completely undermining the anti-enumeration design.\n\nThe `@todo remove in 3.0.0` comment acknowledges the field is scheduled for removal, but it remains active in all 2.x releases, including current 2.14.1.\n\nDiscovered via source code review on May 29, 2026.\n\n## Details\n\nThe mutation resolver in `src/Mutation/SendPasswordResetEmail.php`:\n\n```php\n$payload = [\u0027success\u0027 =\u003e true, \u0027id\u0027 =\u003e null];\n$user_data = self::get_user_data($input[\u0027username\u0027]);\nif (!$user_data) {\n graphql_debug(...);\n return $payload; // id stays null\n}\n// ...send email, then...\nreturn [\u0027id\u0027 =\u003e $user_data-\u003eID, \u0027success\u0027 =\u003e true];\n```\n\nThe intended public output field is only `success`. The `id` is internal-only state for downstream resolvers.\n\n`src/Deprecated.php` registers an additional `user` field on the same payload type:\n\n```php\nregister_graphql_field(\n \u0027SendPasswordResetEmailPayload\u0027,\n \u0027user\u0027,\n [\n \u0027type\u0027 =\u003e \u0027User\u0027,\n \u0027deprecationReason\u0027 =\u003e static function () { return __(\u0027This field will be removed...\u0027); },\n \u0027resolve\u0027 =\u003e static function ($payload, $args, AppContext $context) {\n return !empty($payload[\u0027id\u0027])\n ? $context-\u003eget_loader(\u0027user\u0027)-\u003eload_deferred($payload[\u0027id\u0027])\n : null;\n },\n ],\n);\n```\n\nThis field reads the internal `$payload[\u0027id\u0027]` and resolves it through the standard user loader. The User Model\u0027s `allowed_restricted_fields` policy permits unauthenticated reads of public author fields (`databaseId`, `name`, `firstName`, `lastName`, `slug`, `description`, `uri`, `url`).\n\n## PoC\n\n```graphql\nmutation EnumerateUser {\n sendPasswordResetEmail(input: { username: \"victim@example.com\" }) {\n success\n user {\n databaseId\n name\n firstName\n lastName\n slug\n description\n uri\n }\n }\n}\n```\n\nBehavior:\n- Non-existing user/email \u2192 `data.sendPasswordResetEmail.user` is `null`\n- - Existing author-class user \u2192 `data.sendPasswordResetEmail.user` is a full User object with the listed fields populated\n- - `success` always returns `true`, preserving the appearance of obfuscation \u2014 the deprecated `user` field is the leak\n## Impact\n\n1. **Username/email enumeration:** unauthenticated attacker can verify whether any username or email is registered, with no WPGraphQL-side rate limiting\n2. 2. **Profile disclosure for author-class users:** for any user with published posts (including editors and administrators), the attacker obtains `databaseId`, `name`, `firstName`, `lastName`, `slug`, `description` (user bio), `uri` \u2014 substantially more than mere existence\n3. 3. **Bypasses partial hardening:** sites that disabled the REST API user endpoint, the user XML sitemap, and `?author=N` author redirects may still be vulnerable through this WPGraphQL path\n4. 4. **Spearphishing setup:** firstName/lastName/description for authors provides personalized phishing material\n## Recommended fix\n\nEither remove the deprecated `user` field entirely (advance the existing `@todo remove in 3.0.0`) or change the resolver to always return `null`:\n\n```diff\n\u0027resolve\u0027 =\u003e static function ($payload, $args, AppContext $context) {\n- return !empty($payload[\u0027id\u0027]) ? $context-\u003eget_loader(\u0027user\u0027)-\u003eload_deferred($payload[\u0027id\u0027]) : null;\n- + // Always null \u2014 this deprecated field previously leaked user existence,\n- + // undermining the anti-enumeration design of the sendPasswordResetEmail mutation.\n- + return null;\n- },\n- ```\nDefense in depth \u2014 change the mutation resolver itself to not populate `$payload[\u0027id\u0027]` on real success:\n\n```diff\nreturn [\n- \u0027id\u0027 =\u003e $user_data-\u003eID,\n- + \u0027id\u0027 =\u003e null,\n- \u0027success\u0027 =\u003e true,\n- ];\n- ```\n\nLuke Granto \u2014 independent security researcher operating in good faith. Discovery via source code review of wp-graphql/wp-graphql v2.14.1, approximately 15 minutes from `git clone` to confirmed bug. No live exploitation against any third-party deployment.",
"id": "GHSA-jhh7-832h-f8hv",
"modified": "2026-07-31T22:24:29Z",
"published": "2026-07-31T22:24:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv"
},
{
"type": "PACKAGE",
"url": "https://github.com/wp-graphql/wp-graphql"
},
{
"type": "WEB",
"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)"
}
GHSA-JRJQ-9CMF-3H6F
Vulnerability from github – Published: 2026-08-04 15:32 – Updated: 2026-08-05 21:31In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
{
"affected": [],
"aliases": [
"CVE-2026-60007"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-04T13:18:55Z",
"severity": "CRITICAL"
},
"details": "In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim\u0027s `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim\u0027s password, and authenticate with the recovered credentials.",
"id": "GHSA-jrjq-9cmf-3h6f",
"modified": "2026-08-05T21:31:34Z",
"published": "2026-08-04T15:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60007"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/183"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JRMV-PJXX-F4C4
Vulnerability from github – Published: 2025-02-12 15:31 – Updated: 2025-02-12 15:31A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2025-1101"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:31Z",
"severity": "MODERATE"
},
"details": "A CWE-204 \"Observable Response Discrepancy\" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests.",
"id": "GHSA-jrmv-pjxx-f4c4",
"modified": "2025-02-12T15:31:59Z",
"published": "2025-02-12T15:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1101"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1101"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JV87-32HW-HH99
Vulnerability from github – Published: 2026-03-20 20:47 – Updated: 2026-03-27 21:59Impact
What kind of vulnerability is it? Who is impacted?
MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects.
All deployments with LDAP configured running an affected version are impacted.
There are two vulnerabilities:
- User Enumeration via Distinguishable Error Messages (CWE-204)
- Missing Rate Limiting on STS Authentication Endpoints (CWE-307)
When exploited together, an attacker can:
- Enumerate valid LDAP usernames by observing error message differences.
- Perform high-speed password brute-force attacks against confirmed valid users.
- Upon finding valid credentials, obtain temporary AWS-style STS credentials (
AccessKeyId,SecretAccessKey,SessionToken) with full access to the victim user's S3 resources.
Affected Versions
All MinIO releases through the final release of the minio/minio open-source project.
Patches
Fixed in: MinIO AIStor RELEASE.2026-03-17T21-25-16Z
Binary Downloads
| Platform | Architecture | Download |
|---|---|---|
| Linux | amd64 | minio |
| Linux | arm64 | minio |
| macOS | arm64 | minio |
| macOS | amd64 | minio |
| Windows | amd64 | minio.exe |
FIPS Binaries
| Platform | Architecture | Download |
|---|---|---|
| Linux | amd64 | minio.fips |
| Linux | arm64 | minio.fips |
Package Downloads
| Format | Architecture | Download |
|---|---|---|
| DEB | amd64 | minio_20260317212516.0.0_amd64.deb |
| DEB | arm64 | minio_20260317212516.0.0_arm64.deb |
| RPM | amd64 | minio-20260317212516.0.0-1.x86_64.rpm |
| RPM | arm64 | minio-20260317212516.0.0-1.aarch64.rpm |
Container Images
# Standard
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
# FIPS
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips
Homebrew (macOS)
brew install minio/aistor/minio
Workarounds
If upgrading is not immediately possible:
- Network-level rate limiting: Use a reverse proxy (e.g., nginx, HAProxy) or WAF to rate-limit requests to the
/?Action=AssumeRoleWithLDAPIdentityendpoint. - Firewall restrictions: Restrict access to the STS endpoint to trusted networks/IP ranges only.
- LDAP account lockout: Configure account lockout policies on the LDAP server itself (e.g., Active Directory lockout threshold). Note: this protects against brute-force but not enumeration, and may cause denial-of-service for legitimate users.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/minio/minio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.0-20260212201848-7aac2a2c5b7c"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33419"
],
"database_specific": {
"cwe_ids": [
"CWE-204",
"CWE-307"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-20T20:47:54Z",
"nvd_published_at": "2026-03-24T20:16:29Z",
"severity": "CRITICAL"
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nMinIO AIStor\u0027s STS (Security Token Service) `AssumeRoleWithLDAPIdentity` endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim\u0027s S3 buckets and objects.\n\nAll deployments with LDAP configured running an affected version are impacted.\n\nThere are two vulnerabilities:\n\n1. User Enumeration via Distinguishable Error Messages (CWE-204)\n2. Missing Rate Limiting on STS Authentication Endpoints (CWE-307)\n\nWhen exploited together, an attacker can:\n\n1. Enumerate valid LDAP usernames by observing error message differences.\n3. Perform high-speed password brute-force attacks against confirmed valid users.\n4. Upon finding valid credentials, obtain temporary AWS-style STS credentials (`AccessKeyId`, `SecretAccessKey`, `SessionToken`) with full access to the victim user\u0027s S3 resources.\n\n### Affected Versions\n\nAll MinIO releases through the final release of the minio/minio open-source project.\n\n### Patches\n\n**Fixed in**: MinIO AIStor RELEASE.2026-03-17T21-25-16Z\n\n#### Binary Downloads\n\n| Platform | Architecture | Download |\n| -------- | ------------ | --------------------------------------------------------------------------- |\n| Linux | amd64 | [minio](https://dl.min.io/aistor/minio/release/linux-amd64/minio) |\n| Linux | arm64 | [minio](https://dl.min.io/aistor/minio/release/linux-arm64/minio) |\n| macOS | arm64 | [minio](https://dl.min.io/aistor/minio/release/darwin-arm64/minio) |\n| macOS | amd64 | [minio](https://dl.min.io/aistor/minio/release/darwin-amd64/minio) |\n| Windows | amd64 | [minio.exe](https://dl.min.io/aistor/minio/release/windows-amd64/minio.exe) |\n\n#### FIPS Binaries\n\n| Platform | Architecture | Download |\n| -------- | ------------ | --------------------------------------------------------------------------- |\n| Linux | amd64 | [minio.fips](https://dl.min.io/aistor/minio/release/linux-amd64/minio.fips) |\n| Linux | arm64 | [minio.fips](https://dl.min.io/aistor/minio/release/linux-arm64/minio.fips) |\n\n#### Package Downloads\n\n| Format | Architecture | Download |\n| ------ | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- |\n| DEB | amd64 | [minio_20260317212516.0.0_amd64.deb](https://dl.min.io/aistor/minio/release/linux-amd64/minio_20260317212516.0.0_amd64.deb) |\n| DEB | arm64 | [minio_20260317212516.0.0_arm64.deb](https://dl.min.io/aistor/minio/release/linux-arm64/minio_20260317212516.0.0_arm64.deb) |\n| RPM | amd64 | [minio-20260317212516.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/release/linux-amd64/minio-20260317212516.0.0-1.x86_64.rpm) |\n| RPM | arm64 | [minio-20260317212516.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/release/linux-arm64/minio-20260317212516.0.0-1.aarch64.rpm) |\n\n#### Container Images\n\n```bash\n# Standard\ndocker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z\npodman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z\n\n# FIPS\ndocker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips\npodman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips\n```\n\n#### Homebrew (macOS)\n\n```bash\nbrew install minio/aistor/minio\n```\n \n\n### Workarounds\n\n- [Users of the open-source `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-03-17T21-25-16Z` or later.](https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/community-edition/)\n\nIf upgrading is not immediately possible:\n\n- **Network-level rate limiting**: Use a reverse proxy (e.g., nginx, HAProxy) or WAF to rate-limit requests to the `/?Action=AssumeRoleWithLDAPIdentity` endpoint.\n- **Firewall restrictions**: Restrict access to the STS endpoint to trusted networks/IP ranges only.\n- **LDAP account lockout**: Configure account lockout policies on the LDAP server itself (e.g., Active Directory lockout threshold). Note: this protects against brute-force but not enumeration, and may cause denial-of-service for legitimate users.",
"id": "GHSA-jv87-32hw-hh99",
"modified": "2026-03-27T21:59:08Z",
"published": "2026-03-20T20:47:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/minio/minio/security/advisories/GHSA-jv87-32hw-hh99"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33419"
},
{
"type": "PACKAGE",
"url": "https://github.com/minio/minio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MinIO LDAP login brute-force via user enumeration and missing rate limit"
}
GHSA-JVFW-53C8-P9QG
Vulnerability from github – Published: 2024-11-15 18:30 – Updated: 2024-11-15 18:30A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device.
This vulnerability is due to differences in authentication responses that are sent back from the application as part of an authentication attempt. An attacker could exploit this vulnerability by sending authentication requests to an affected device. A successful exploit could allow the attacker to confirm existing user accounts, which could be used in further attacks. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-20633"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T17:15:10Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based management interface of Cisco\u0026nbsp;ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device.\n\nThis vulnerability is due to differences in authentication responses that are sent back from the application as part of an authentication attempt. An attacker could exploit this vulnerability by sending authentication requests to an affected device. A successful exploit could allow the attacker to confirm existing user accounts, which could be used in further attacks.\nCisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
"id": "GHSA-jvfw-53c8-p9qg",
"modified": "2024-11-15T18:30:51Z",
"published": "2024-11-15T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20633"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-multivulns-kbK2yVhR"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JVQ2-W86Q-PW44
Vulnerability from github – Published: 2023-05-30 21:30 – Updated: 2024-04-04 04:23Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy
{
"affected": [],
"aliases": [
"CVE-2023-31186"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-30T20:15:10Z",
"severity": "MODERATE"
},
"details": "Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy",
"id": "GHSA-jvq2-w86q-pw44",
"modified": "2024-04-04T04:23:59Z",
"published": "2023-05-30T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31186"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/Departments/faq/cve_advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M24V-F7G5-GQ67
Vulnerability from github – Published: 2026-05-06 20:54 – Updated: 2026-05-13 16:42Impact
Responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks.
Patches
This has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "statamic/cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.73.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "statamic/cms"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.15.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44306"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T20:54:31Z",
"nvd_published_at": "2026-05-12T22:16:37Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nResponses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks.\n\n### Patches\n\nThis has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user.",
"id": "GHSA-m24v-f7g5-gq67",
"modified": "2026-05-13T16:42:52Z",
"published": "2026-05-06T20:54:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/statamic/cms/security/advisories/GHSA-m24v-f7g5-gq67"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44306"
},
{
"type": "PACKAGE",
"url": "https://github.com/statamic/cms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Statamic CMS vulnerable to email enumeration via forgot password endpoint"
}
GHSA-M99F-MMVG-3XMX
Vulnerability from github – Published: 2026-03-25 19:53 – Updated: 2026-03-25 19:53Summary
The password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three distinct JSON error responses.
Details
In objects/userRecoverPass.php, the request flow is:
- Line 11 — A
Userobject is instantiated from unsanitized$_REQUEST['user']with no authentication:
$user = new User(0, $_REQUEST['user'], false);
- Lines 27-29 — If the user does not exist, a distinct error is returned immediately:
if (empty($user->getStatus())) {
$obj->error = __("User not found");
die(json_encode($obj));
}
- Lines 31-33 — If the user exists but is not active, a different distinct error is returned:
if ($user->getStatus() !== 'a') {
$obj->error = __("The user is not active");
die(json_encode($obj));
}
- Lines 37-41 — Captcha validation only occurs after both user enumeration checks:
if (empty($_REQUEST['captcha'])) {
$obj->error = __("Captcha is empty");
} else {
require_once 'captcha.php';
$valid = Captcha::validation($_REQUEST['captcha']);
This ordering creates a reliable oracle: requests that hit the captcha check confirm the user exists and is active, while the two earlier error messages reveal non-existence or inactive status — all without requiring a valid captcha.
By contrast, the registration endpoint (objects/userCreate.json.php) correctly validates the captcha at lines 32-42 before performing any user existence checks, confirming this ordering in the password recovery endpoint is a bug.
No rate limiting (rateLimitByIP) or brute force protection (bruteForceBlock) is applied to this endpoint. The framework's session-based DDOS protection is trivially bypassed by omitting cookies (each request gets a fresh session).
PoC
# 1. Test a non-existent user — returns "User not found" without captcha
curl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \
-d 'user=nonexistent_user_xyz&captcha=' | jq .error
# Response: "User not found"
# 2. Test a valid active user — passes user checks, hits captcha validation
curl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \
-d 'user=admin&captcha=' | jq .error
# Response: "Captcha is empty"
# 3. Test an inactive/banned user (if one exists) — returns distinct status message
curl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \
-d 'user=banned_user&captcha=' | jq .error
# Response: "The user is not active"
# 4. Bulk enumeration script — no captcha solving required
for user in admin root test user1 user2 moderator editor; do
result=$(curl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \
-d "user=${user}&captcha=")
error=$(echo "$result" | jq -r .error)
if [ "$error" = "Captcha is empty" ]; then
echo "[ACTIVE] $user"
elif [ "$error" = "The user is not active" ]; then
echo "[INACTIVE] $user"
else
echo "[NOT FOUND] $user"
fi
done
Impact
- Username enumeration: Attackers can determine which usernames are registered on the platform without any captcha or authentication barrier.
- Account status disclosure: Attackers can distinguish between active, inactive, and non-existent accounts, revealing moderation/ban status.
- Credential stuffing enablement: Confirmed valid usernames can be used in targeted password brute-force or credential stuffing attacks against the login endpoint.
- Phishing: Knowledge of valid active accounts enables targeted social engineering attacks against real users.
- No throttling: The absence of rate limiting on this endpoint allows high-speed automated enumeration.
Recommended Fix
Move the captcha validation before the user existence checks, and return a generic message regardless of user status:
// In objects/userRecoverPass.php, replace lines 26-41 with:
header('Content-Type: application/json');
// Validate captcha FIRST, before any user lookups
if (empty($_REQUEST['captcha'])) {
$obj->error = __("Captcha is empty");
die(json_encode($obj));
}
require_once 'captcha.php';
$valid = Captcha::validation($_REQUEST['captcha']);
if (!$valid) {
$obj->error = __("Your code is not valid");
$obj->reloadCaptcha = true;
die(json_encode($obj));
}
// After captcha passes, check user — but use generic message
if (empty($user->getStatus()) || $user->getStatus() !== 'a' || empty($user->getEmail())) {
// Generic message — do not reveal whether user exists or is active
$obj->success = __("If this account exists, a recovery email has been sent");
die(json_encode($obj));
}
// Proceed with actual password recovery...
$recoverPass = $user->setRecoverPass();
Additionally, consider adding rateLimitByIP() to this endpoint as defense-in-depth.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33688"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-25T19:53:00Z",
"nvd_published_at": "2026-03-23T19:16:42Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe password recovery endpoint at `objects/userRecoverPass.php` performs user existence and account status checks **before** validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned \u2014 at scale and without solving any captcha \u2014 by observing three distinct JSON error responses.\n\n## Details\n\nIn `objects/userRecoverPass.php`, the request flow is:\n\n1. **Line 11** \u2014 A `User` object is instantiated from unsanitized `$_REQUEST[\u0027user\u0027]` with no authentication:\n```php\n$user = new User(0, $_REQUEST[\u0027user\u0027], false);\n```\n\n2. **Lines 27-29** \u2014 If the user does not exist, a distinct error is returned immediately:\n```php\nif (empty($user-\u003egetStatus())) {\n $obj-\u003eerror = __(\"User not found\");\n die(json_encode($obj));\n}\n```\n\n3. **Lines 31-33** \u2014 If the user exists but is not active, a different distinct error is returned:\n```php\nif ($user-\u003egetStatus() !== \u0027a\u0027) {\n $obj-\u003eerror = __(\"The user is not active\");\n die(json_encode($obj));\n}\n```\n\n4. **Lines 37-41** \u2014 Captcha validation only occurs **after** both user enumeration checks:\n```php\nif (empty($_REQUEST[\u0027captcha\u0027])) {\n $obj-\u003eerror = __(\"Captcha is empty\");\n} else {\n require_once \u0027captcha.php\u0027;\n $valid = Captcha::validation($_REQUEST[\u0027captcha\u0027]);\n```\n\nThis ordering creates a reliable oracle: requests that hit the captcha check confirm the user exists and is active, while the two earlier error messages reveal non-existence or inactive status \u2014 all without requiring a valid captcha.\n\nBy contrast, the registration endpoint (`objects/userCreate.json.php`) correctly validates the captcha at lines 32-42 **before** performing any user existence checks, confirming this ordering in the password recovery endpoint is a bug.\n\nNo rate limiting (`rateLimitByIP`) or brute force protection (`bruteForceBlock`) is applied to this endpoint. The framework\u0027s session-based DDOS protection is trivially bypassed by omitting cookies (each request gets a fresh session).\n\n## PoC\n\n```bash\n# 1. Test a non-existent user \u2014 returns \"User not found\" without captcha\ncurl -s -X POST \u0027http://localhost/AVideo/objects/userRecoverPass.php\u0027 \\\n -d \u0027user=nonexistent_user_xyz\u0026captcha=\u0027 | jq .error\n# Response: \"User not found\"\n\n# 2. Test a valid active user \u2014 passes user checks, hits captcha validation\ncurl -s -X POST \u0027http://localhost/AVideo/objects/userRecoverPass.php\u0027 \\\n -d \u0027user=admin\u0026captcha=\u0027 | jq .error\n# Response: \"Captcha is empty\"\n\n# 3. Test an inactive/banned user (if one exists) \u2014 returns distinct status message\ncurl -s -X POST \u0027http://localhost/AVideo/objects/userRecoverPass.php\u0027 \\\n -d \u0027user=banned_user\u0026captcha=\u0027 | jq .error\n# Response: \"The user is not active\"\n\n# 4. Bulk enumeration script \u2014 no captcha solving required\nfor user in admin root test user1 user2 moderator editor; do\n result=$(curl -s -X POST \u0027http://localhost/AVideo/objects/userRecoverPass.php\u0027 \\\n -d \"user=${user}\u0026captcha=\")\n error=$(echo \"$result\" | jq -r .error)\n if [ \"$error\" = \"Captcha is empty\" ]; then\n echo \"[ACTIVE] $user\"\n elif [ \"$error\" = \"The user is not active\" ]; then\n echo \"[INACTIVE] $user\"\n else\n echo \"[NOT FOUND] $user\"\n fi\ndone\n```\n\n## Impact\n\n- **Username enumeration**: Attackers can determine which usernames are registered on the platform without any captcha or authentication barrier.\n- **Account status disclosure**: Attackers can distinguish between active, inactive, and non-existent accounts, revealing moderation/ban status.\n- **Credential stuffing enablement**: Confirmed valid usernames can be used in targeted password brute-force or credential stuffing attacks against the login endpoint.\n- **Phishing**: Knowledge of valid active accounts enables targeted social engineering attacks against real users.\n- **No throttling**: The absence of rate limiting on this endpoint allows high-speed automated enumeration.\n\n## Recommended Fix\n\nMove the captcha validation before the user existence checks, and return a generic message regardless of user status:\n\n```php\n// In objects/userRecoverPass.php, replace lines 26-41 with:\n\n header(\u0027Content-Type: application/json\u0027);\n\n // Validate captcha FIRST, before any user lookups\n if (empty($_REQUEST[\u0027captcha\u0027])) {\n $obj-\u003eerror = __(\"Captcha is empty\");\n die(json_encode($obj));\n }\n require_once \u0027captcha.php\u0027;\n $valid = Captcha::validation($_REQUEST[\u0027captcha\u0027]);\n if (!$valid) {\n $obj-\u003eerror = __(\"Your code is not valid\");\n $obj-\u003ereloadCaptcha = true;\n die(json_encode($obj));\n }\n\n // After captcha passes, check user \u2014 but use generic message\n if (empty($user-\u003egetStatus()) || $user-\u003egetStatus() !== \u0027a\u0027 || empty($user-\u003egetEmail())) {\n // Generic message \u2014 do not reveal whether user exists or is active\n $obj-\u003esuccess = __(\"If this account exists, a recovery email has been sent\");\n die(json_encode($obj));\n }\n\n // Proceed with actual password recovery...\n $recoverPass = $user-\u003esetRecoverPass();\n```\n\nAdditionally, consider adding `rateLimitByIP()` to this endpoint as defense-in-depth.",
"id": "GHSA-m99f-mmvg-3xmx",
"modified": "2026-03-25T19:53:00Z",
"published": "2026-03-25T19:53:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33688"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/e42f54123b460fd1b2ee01f2ce3d4a386e88d157"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint"
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-331: ICMP IP Total Length Field Probe
An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.
CAPEC-332: ICMP IP 'ID' Field Error Message Probe
An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.
CAPEC-541: Application Fingerprinting
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.
CAPEC-580: System Footprinting
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.