目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-204 响应差异性信息暴露 类漏洞列表 156

CWE-204 响应差异性信息暴露 类弱点 156 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-204 属于信息泄露类漏洞，指系统对请求的响应差异暴露了内部状态。攻击者常利用响应时间、错误消息或行为模式的细微差别，推断服务器内部逻辑、文件存在性或认证状态，从而辅助后续攻击。开发者应避免在错误处理中暴露敏感细节，确保对合法与非法请求返回统一、通用的响应格式，并消除基于内部状态的差异化反馈，以阻断信息泄露路径。

MITRE CWE 官方描述
CWE：CWE-204 Observable Response Discrepancy 英文：The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. 译文：产品以某种方式对传入请求提供不同的响应，从而向预期控制范围之外的未授权实体泄露内部状态信息。
常见影响 (1)
Confidentiality, Access ControlRead Application Data, Bypass Protection Mechanism
缓解措施 (2)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
ImplementationEnsure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
代码示例 (1)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
CVE ID标题CVSS风险等级Published
CVE-2021-20049 Sonicwall SMA100 信息泄露漏洞 — SonicWall SMA100 7.5 -2021-12-23
CVE-2021-34580 MB CONNECT LINE mbCONNECT24和MB CONNECT LINE mymbCONNECT24 安全漏洞 — mymbCONNECT24 7.5 High2021-10-27
CVE-2021-38476 IR615 Router 安全漏洞 — IR615 Router 6.5 Medium2021-10-19
CVE-2021-39189 Pimcore 信息泄露漏洞 — pimcore 5.3 Medium2021-09-15
CVE-2020-11063 TYPO3 Password Reset组件信息泄露漏洞 — TYPO3 CMS 3.7 Low2020-05-13
CVE-2016-9499 Accellion FTP server 信息泄露漏洞 — FTP Server 5.3 -2018-07-13

CWE-204（响应差异性信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 156 条 CVE 漏洞。