CWE-206 상세 정보

The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

취약점 도입 방식

Architecture and Design
Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

일반적인 결과

관찰된 예시

잠재적 완화 방법

Phases : Requirements // Implementation
Phases : System Configuration // Implementation
For error pages, set up generic response pages for error conditions. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account names may be able to guess some of them. Confirming that the account exists would make the login page more susceptible to brute force attack, or possibly leak information about the person who has the account.

취약점 매핑 메모

근거 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

제출

수정 사항