528
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Potential Mitigations
Setup generic response pages for error conditions. The error page should not disclose
information about the success or failure of a sensitive operation. For instance, the login page
should not confirm that the login is correct and the password incorrect. The attacker who tries
random account name may be able to guess some of them. Confirming that the account exists
would make the login page more susceptible to brute force attack.
Observed Examples
Reference Description
CVE-2002-2031 File existence via infoleak monitoring whether "onerror" handler fires or not.
https://www.cve.org/CVERecord?id=CVE-2002-2031
CVE-2005-2025 Valid groupname enumeration via behavioral infoleak (sends response if valid,
doesn't respond if not).
https://www.cve.org/CVERecord?id=CVE-2005-2025
CVE-2001-1497 Behavioral infoleak in GUI allows attackers to distinguish between
alphanumeric and non-alphanumeric characters in a password, thus reducing
the search space.
https://www.cve.org/CVERecord?id=CVE-2001-1497
CVE-2003-0190 Product immediately sends an error message when user does not exist instead
of waiting until the password is provided, allowing username enumeration.
https://www.cve.org/CVERecord?id=CVE-2003-0190
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 967 SFP Secondary Cluster: State Disclosure 888 2403
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Internal behavioral inconsistency
infoleak
CWE-207: Observable Behavioral Discrepancy With Equivalent Products
Weakness ID : 207
Structure : Simple
Abstraction : Variant
Description
The product operates in an environment in which its existence or specific identity should not be
known, but it behaves differently than other products with equivalent functionality, in a way that is
observable to an attacker.
Extended Description
For many kinds of products, multiple products may be available that perform the same functionality,
such as a web server, network interface, or intrusion detection system. Attackers often perform
"fingerprinting," which uses discrepancies in order to identify which specific product is in use. Once
CWE Version 4.14
CWE-208: Observable Timing Discrepancy
CWE-208: Observable Timing Discrepancy