CWE-203 Base Incomplete

Observable Discrepancy

This vulnerability occurs when an application responds differently to unauthorized users based on internal conditions. Attackers can observe these variations—like changes in error messages, timing,…

Definition

What is CWE-203?

This vulnerability occurs when an application responds differently to unauthorized users based on internal conditions. Attackers can observe these variations—like changes in error messages, timing, or system behavior—to infer sensitive information, such as whether a username exists, a password is incorrect, or a specific operation succeeded.
Observable discrepancies act as unintended information leaks, providing attackers with clues about your system's internal state. These variations can appear in multiple forms: differences in response times (timing attacks), changes in error messages or HTTP status codes, alternate control flows, or even subtle behavioral shifts in the application. Attackers systematically probe these differences to map valid user accounts, guess credentials, or determine the structure of backend systems. In practice, this flaw often enables brute-force attacks or reconnaissance by removing the "blindness" from an attacker's attempts. For example, a login endpoint that returns "invalid username" versus "invalid password" tells an attacker exactly which piece of data is correct. Over time, these small information leaks can be combined to form a complete side channel, bypassing security controls that rely on keeping the system's responses uniform and unpredictable.
Real-world impact

Real-world CVEs caused by CWE-203

  • CVE-2020-8695

    Observable discrepancy in the RAPL interface for some Intel processors allows information disclosure.

  • CVE-2019-14353

    Crypto hardware wallet's power consumption relates to total number of pixels illuminated, creating a side channel in the USB connection that allows attackers to determine secrets displayed such as PIN numbers and passwords

  • CVE-2019-10071

    Java-oriented framework compares HMAC signatures using String.equals() instead of a constant-time algorithm, causing timing discrepancies

  • CVE-2002-2094

    This, and others, use ".." attacks and monitor error responses, so there is overlap with directory traversal.

  • CVE-2001-1483

    Enumeration of valid usernames based on inconsistent responses

  • CVE-2001-1528

    Account number enumeration via inconsistent responses.

  • CVE-2004-2150

    User enumeration via discrepancies in error messages.

  • CVE-2005-1650

    User enumeration via discrepancies in error messages.

How attackers exploit it

Step-by-step attacker path

  1. 1

    The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.

  2. 2

    In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.

  3. 3

    While this type of information may be helpful to a user, it is also useful to a potential attacker. In the above example, the message for both failed cases should be the same, such as:

  4. 4

    In this example, the attacker observes how long an authentication takes when the user types in the correct password.

  5. 5

    When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.

Vulnerable code example

Vulnerable Perl

The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.

Vulnerable Perl 
my $username=param('username'); 
  my $password=param('password'); 
  if (IsValidUsername($username) == 1) 
  { 
  	if (IsValidPassword($username, $password) == 1) 
  	{ 
  		print "Login Successful"; 
  	} 
  	else 
  	{ 
  		print "Login Failed - incorrect password"; 
  	} 
  } 
  else 
  { 
  	print "Login Failed - unknown username"; 
  }
Secure code example

Secure Other

In the example above, an attacker may vary the inputs, then observe differences between processing times (since different plaintexts take different time). This could be used to infer information about the key.

Secure Other 
Artificial delays may be added to ensure that all calculations take equal time to execute.
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist

How to prevent CWE-203

  • Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
  • Implementation Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Detection signals

How to detect CWE-203

SAST High

Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.

DAST Moderate

Run dynamic application security testing against the live endpoint.

Runtime Moderate

Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.

Code review Moderate

Code review: flag any new code that handles input from this surface without using the validated framework helpers.

Plexicus auto-fix

Plexicus auto-detects CWE-203 and opens a fix PR in under 60 seconds.

Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.

Get a demo Try Plexicus free
Frequently asked questions

Frequently asked questions

What is CWE-203?

This vulnerability occurs when an application responds differently to unauthorized users based on internal conditions. Attackers can observe these variations—like changes in error messages, timing, or system behavior—to infer sensitive information, such as whether a username exists, a password is incorrect, or a specific operation succeeded.

How serious is CWE-203?

MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.

What languages or platforms are affected by CWE-203?

MITRE lists the following affected platforms: Not Technology-Specific.

How can I prevent CWE-203?

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to…

How does Plexicus detect and fix CWE-203?

Plexicus's SAST engine matches the data-flow signature for CWE-203 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.

Where can I learn more about CWE-203?

MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/203.html. You can also reference OWASP and NIST documentation for adjacent guidance.

Related weaknesses

Weaknesses related to CWE-203

CWE-200 Parent

Exposure of Sensitive Information to an Unauthorized Actor

This weakness occurs when an application unintentionally reveals sensitive data to someone who shouldn't have access to it.

CWE-1258 Sibling

Exposure of Sensitive System Information Due to Uncleared Debug Information

This vulnerability occurs when hardware fails to erase sensitive data like cryptographic keys and intermediate values before entering…

CWE-1273 Sibling

Device Unlock Credential Sharing

This vulnerability occurs when the secret keys or passwords required to unlock a device's hidden features are shared between multiple…

CWE-1295 Sibling

Debug Messages Revealing Unnecessary Information

The product's debug messages or logs expose excessive internal system details, potentially revealing sensitive information that could aid…

CWE-1431 Sibling

Driving Intermediate Cryptographic State/Results to Hardware Module Outputs

This vulnerability occurs when a hardware cryptographic module leaks sensitive internal data through its output channels. Instead of only…

CWE-201 Sibling

Insertion of Sensitive Information Into Sent Data

This vulnerability occurs when an application sends data to an external party, but accidentally includes sensitive information—like…

CWE-209 Sibling

Generation of Error Message Containing Sensitive Information

This vulnerability occurs when an application reveals sensitive details about its internal systems, user data, or environment within error…

CWE-213 Sibling

Exposure of Sensitive Information Due to Incompatible Policies

This vulnerability occurs when a system's data handling aligns with the developer's security rules but accidentally reveals information…

CWE-215 Sibling

Insertion of Sensitive Information Into Debugging Code

This vulnerability occurs when developers embed sensitive data, such as passwords or API keys, within debugging statements like logs or…

Resources

Further reading

Ready when you are

Don't Let Security
Weigh You Down.

Stop choosing between AI velocity and security debt. Plexicus is the only platform that runs Vibe Coding Security and ASPM in parallel — one workflow, every codebase.

Get started free Book a demo