Home/CWE/Observable Discrepancy
Weakness

Observable Discrepancy

CWE-203 · Base · Incomplete

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Children (more specific)
ParentOfCWE-1300 · Improper Protection of Physical Side Channels
ParentOfCWE-1303 · Non-Transparent Sharing of Microarchitectural Resources
ParentOfCWE-204 · Observable Response Discrepancy
ParentOfCWE-205 · Observable Behavioral Discrepancy
ParentOfCWE-208 · Observable Timing Discrepancy
◆

Attack Patterns (CAPEC)

1
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-189Black Box Reverse Engineering
⚠

CVEs With This Weakness

838
A sample of the 838 CVEs tagged with this weakness.
CVECVE-2026-8242
CVECVE-2026-44263
CVECVE-2026-41588
CVECVE-2026-4045
CVECVE-2026-4040
CVECVE-2026-3580
CVECVE-2026-3579
CVECVE-2026-33429
CVECVE-2026-33425
CVECVE-2026-28490
CVECVE-2026-26895
CVECVE-2026-26315
◉

Nuclei Scanner Templates

8
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
highAVM FRITZ!Box 7530 AX - Unauthorized Access
mediumownCloud Guests - User Enumeration
mediumZoho ManageEngine ADSelfService Plus 6121 - Username Enumeration
mediumAnythingLLM - Username Enumeration via Password Recovery
mediumRocket.Chat <3.9.1 - Information Disclosure
mediumPritunl VPN Server 1.29.2145.25 - Username Enumeration
mediumThinfinity VirtualUI User Enumeration
mediumProFTPD 1.2.x - Username Enumeration via Timing Attack
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin