CWE-203 - Observable Discrepancy
CWE-203
- Abstraction:
- Base
- Structure:
- Simple
- Status:
- Incomplete
- Weakness Name
Observable Discrepancy
- Description
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
- Common Consequences
Scope: Confidentiality, Access Control
Impact: Read Application Data, Bypass Protection Mechanism
Notes: An attacker can gain access to sensitive information about the system, including authentication information that may allow an attacker to gain access to the system.
Scope: Confidentiality
Impact: Read Application Data
Notes: When cryptographic primitives are vulnerable to side-channel-attacks, this could be used to reveal unencrypted plaintext in the worst case.
- Related Weaknesses
- Release Date:
- 2006-07-19
- Latest Modification Date:
- 2024-02-29
Free security scan for your website