CWE-206 通过行为不一致性导致的内部状态信息暴露

Information Exposure of Internal State Through Behavioral Inconsistency

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown


Two separate operations in a product cause the product to behave differently in a way that is observable to an attacker and reveals security-relevant information about the internal state of the product, such as whether a particular operation was successful or not.


  • cwe_Nature: ChildOf cwe_CWE_ID: 205 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 205 cwe_View_ID: 699 cwe_Ordinal: Primary


Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}


范围 影响 注释
['Confidentiality', 'Access Control'] ['Read Application Data', 'Bypass Protection Mechanism']



Setup generic response pages for error condition. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account name may be able to guess some of them. Confirming that the account exists would make the login page more susceptible to brute force attack.


标识 说明 链接
CVE-2002-2031 File existence via infoleak monitoring whether "onerror" handler fires or not.
CVE-2005-2025 Valid groupname enumeration via behavioral infoleak (sends response if valid, doesn't respond if not).
CVE-2001-1497 Behavioral infoleak in GUI allows attackers to distinguish between alphanumeric and non-alphanumeric characters in a password, thus reducing the search space.
CVE-2003-0190 Product immediately sends an error message when user does not exist instead of waiting until the password is provided, allowing username enumeration.


映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Internal behavioral inconsistency infoleak