CWE-203Observable Discrepancy

Abstraction: Base · CVEs in our corpus: 818

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Last updated: 16 October 2026 10:19 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-30 Concealment and Misdirection
SC-31 Covert Channel Analysis
SI-11 Error Handling
PR.PS-06

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

1 hardening rule · 1 OS baseline

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (3)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`SI-11`	Error Handling	SI	graded mostly Prevents attackers from using observable differences in error responses to infer internal system details or state.
`SC-30`	Concealment and Misdirection	SC	Misdirection can normalize or falsify responses to eliminate observable discrepancies that aid reconnaissance.
`SC-31`	Covert Channel Analysis	SC	Observable discrepancies in system behavior can be modulated to create covert storage or timing channels; the required analysis detects and constrains such avenues.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-10071`	8.1	9.8	0.0875	2019-09-16
`CVE-2023-28770`	8.1	7.5	0.5778	2023-04-27
`CVE-2022-23303`	7.8	9.8	0.0305	2022-01-17
`CVE-2022-23304`	7.7	9.8	0.0191	2022-01-17
`CVE-2018-1000884`	7.6	9.8	0.0129	2018-12-20
`CVE-2023-40756`	7.5	9.8	0.0089	2023-08-28
`CVE-2024-23771`	7.5	9.8	0.0106	2024-01-22
`CVE-2024-25189`	7.5	9.8	0.0095	2024-02-08
`CVE-2024-25190`	7.5	9.8	0.0090	2024-02-08
`CVE-2024-25191`	7.5	9.8	0.0089	2024-02-08
`CVE-2024-39891` KEV	7.5	5.3	0.0167	2024-07-02
`CVE-2024-25714`	7.4	9.8	0.0081	2024-02-11
`CVE-2025-27667`	7.4	9.8	0.0067	2025-03-05
`CVE-2017-13099`	7.3	7.5	0.2738	2017-12-13
`CVE-2025-39702`	7.3	9.8	0.0043	2025-09-05
`CVE-2026-23519`	7.3	9.8	0.0056	2026-01-15
`CVE-2019-25337`	7.3	9.8	0.0047	2026-02-12
`CVE-2017-13098`	7.2	7.5	0.2428	2017-12-13
`CVE-2022-40895`	7.2	9.1	0.0202	2022-10-06
`CVE-2024-47678`	7.1	9.4	0.0061	2024-10-21
`CVE-2003-0190`	7.0	0.0	0.7675	2003-05-12
`CVE-2017-5715`	7.0	5.6	0.7404	2018-01-04
`CVE-2017-5753`	7.0	5.6	0.9384	2018-01-04
`CVE-2018-3639`	7.0	5.5	0.6063	2018-05-22
`CVE-2023-26556`	7.0	9.1	0.0086	2023-04-21