CWE · MITRE source
CWE-203Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (3)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-30 | Concealment and Misdirection | SC | Misdirection can normalize or falsify responses to eliminate observable discrepancies that aid reconnaissance. |
SC-31 | Covert Channel Analysis | SC | Observable discrepancies in system behavior can be modulated to create covert storage or timing channels; the required analysis detects and constrains such avenues. |
SI-11 | Error Handling | SI | Prevents attackers from using observable differences in error responses to infer internal system details or state. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2017-5753 | 6.8 | 5.6 | 0.9430 | 2018-01-04 |
CVE-2017-5715 | 6.5 | 5.6 | 0.8920 | 2018-01-04 |
CVE-2023-28770 | 6.5 | 7.5 | 0.8369 | 2023-04-27 |
CVE-2017-1000385 | 6.2 | 5.9 | 0.8393 | 2017-12-12 |
CVE-2017-13099 | 6.2 | 7.5 | 0.7871 | 2017-12-13 |
CVE-2017-6168 | 6.1 | 7.4 | 0.7623 | 2017-11-17 |
CVE-2017-13098 | 5.5 | 7.5 | 0.6625 | 2017-12-13 |
CVE-2017-17427 | 5.4 | 5.9 | 0.7047 | 2017-12-13 |
CVE-2017-12373 | 5.2 | 5.9 | 0.6694 | 2017-12-15 |
CVE-2021-44848 | 4.7 | 5.3 | 0.6065 | 2021-12-13 |
CVE-2019-16394 | 4.5 | 5.3 | 0.5674 | 2019-09-17 |
CVE-2020-25200 | 4.5 | 5.3 | 0.5739 | 2020-10-01 |
CVE-2024-5124 | 4.3 | 7.5 | 0.4613 | 2024-06-06 |
CVE-2024-39891 KEV | 4.1 | 5.3 | 0.1707 | 2024-07-02 |
CVE-2018-3639 | 3.9 | 5.5 | 0.4602 | 2018-05-22 |
CVE-2020-28208 | 3.8 | 5.3 | 0.4632 | 2021-01-08 |
CVE-2019-16516 | 3.4 | 5.3 | 0.3821 | 2020-01-23 |
CVE-2024-51739 | 3.4 | 7.5 | 0.3158 | 2024-11-05 |
CVE-2025-24011 | 3.2 | 5.3 | 0.3516 | 2025-01-21 |
CVE-2019-10071 | 2.5 | 9.8 | 0.0982 | 2019-09-16 |
CVE-2019-13383 | 2.3 | 5.3 | 0.2044 | 2019-07-16 |
CVE-2021-45901 | 2.2 | 5.3 | 0.1958 | 2022-02-10 |
CVE-2022-24436 | 2.2 | 6.5 | 0.1487 | 2022-06-15 |
CVE-2021-20147 | 2.1 | 5.3 | 0.1803 | 2022-01-03 |
CVE-2018-1000884 | 2.0 | 9.8 | 0.0057 | 2018-12-20 |