518
CWE-203: Observable Discrepancy
Weakness ID : 203
Structure : Simple
Abstraction : Base
Description
The product behaves differently or sends different responses under different circumstances in a
way that is observable to an unauthorized actor, which exposes security-relevant information about
the state of the product, such as whether a particular operation was successful or not.
Extended Description
Discrepancies can take many forms, and variations may be detectable in timing, control flow,
communications such as replies or requests, or general behavior. These discrepancies can reveal
information about the product's operation or internal state to an unauthorized actor. In some cases,
discrepancies can be used by attackers to form a side channel.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 200 Exposure of Sensitive Information to an Unauthorized Actor 504
ParentOf 204 Observable Response Discrepancy 523
ParentOf 205 Observable Behavioral Discrepancy 526
ParentOf 208 Observable Timing Discrepancy 529
ParentOf 1300 Improper Protection of Physical Side Channels 2165
ParentOf 1303 Non-Transparent Sharing of Microarchitectural Resources 2174
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 200 Exposure of Sensitive Information to an Unauthorized Actor 504
Relevant to the view "Hardware Design" (CWE-1194)
Nature Type ID Name Page
ParentOf 1300 Improper Protection of Physical Side Channels 2165
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Alternate Terms
Side Channel Attack : Observable Discrepancies are at the root of side channel attacks.
Common Consequences
Scope Impact Likelihood
Confidentiality
Access Control
Read Application Data
Bypass Protection Mechanism
An attacker can gain access to sensitive information about
the system, including authentication information that may
allow an attacker to gain access to the system.
CWE Version 4.14
CWE-203: Observable Discrepancy
CWE-203: Observable Discrepancy