Description
The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.
Ideally, a product should provide as little information about its internal operations as possible. Otherwise, attackers could use knowledge of these internal operations to simplify or optimize their attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel.
Potential Impact
Confidentiality, Access Control
Read Application Data, Bypass Protection Mechanism
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2002-0208 | Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use. |
| CVE-2004-2252 | Behavioral infoleak by responding to SYN-FIN packets. |
Related Weaknesses
Taxonomy Mappings
- PLOVER: — Behavioral Discrepancy Infoleak
- WASC: 45 — Fingerprinting
Frequently Asked Questions
What is CWE-205?
CWE-205 (Observable Behavioral Discrepancy) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other produ...
How can CWE-205 be exploited?
Attackers can exploit CWE-205 (Observable Behavioral Discrepancy) to read application data, bypass protection mechanism. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-205?
Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.
What is the severity of CWE-205?
CWE-205 is classified as a Base-level weakness (Medium abstraction). It has been observed in 2 real-world CVEs.