CWEweakness

CWE-205 Observable Behavioral Discrepancy

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.

Common consequences

• Confidentiality, Access Control: Read Application Data, Bypass Protection Mechanism — Attackers could use knowledge of these internal operations to simplify or optimize their attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel.

Potential mitigations

• [Implementation] Ideally, a product should provide as little information about its internal operations as possible.

Observed examples

• CVE-2002-0208: Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use. • CVE-2004-2252: Behavioral infoleak by responding to SYN-FIN packets.

Related

Attack pattern · CAPEC (2)

  • CAPEC-541 Application Fingerprinting attack pattern
  • CAPEC-580 System Footprinting attack pattern

Observed example · CVE (2)

  • CVE-2004-2252 The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain… vulnerability
  • CVE-2002-0208 PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows… vulnerability

Can precede · CWE (1)

Child of · CWE (1)

  • CWE-203 Observable Discrepancy weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-541 Application Fingerprinting attack pattern
  • CAPEC-580 System Footprinting attack pattern

Referenced by CVE · weakness (3)

  • CVE-2026-109125 In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with… vulnerability
  • CVE-2024-6129 A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. vulnerability
  • CVE-2017-11155 An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to… vulnerability

Referenced by CWE · child of (2)

  • CWE-206 Observable Internal Behavioral Discrepancy weakness
  • CWE-207 Observable Behavioral Discrepancy With Equivalent Products weakness