523
Related Attack Patterns
CAPEC-ID Attack Pattern Name
189 Black Box Reverse Engineering
CWE-204: Observable Response Discrepancy
Weakness ID : 204
Structure : Simple
Abstraction : Base
Description
The product provides different responses to incoming requests in a way that reveals internal state
information to an unauthorized actor outside of the intended control sphere.
Extended Description
This issue frequently occurs during authentication, where a difference in failed-login messages
could allow an attacker to determine if the username is valid or not. These exposures can be
inadvertent (bug) or intentional (design).
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 203 Observable Discrepancy 518
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 199 Information Management Errors 2312
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Access Control
Read Application Data
Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Strategy = Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Phase: Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience
and no one else. The messages need to strike the balance between being too cryptic (which
CWE Version 4.14
CWE-204: Observable Response Discrepancy
CWE-204: Observable Response Discrepancy