CWE-203— Observable Discrepancy (Information Exposure via Side Channel)

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.— MITRE CWE catalog

869 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-203page 8 of 18

CVE-2023-21320MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges n…
CVE-2023-21319MEDIUMCVSS 5.5EG 5.5
2023-10-30
In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is …
CVE-2023-21318MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges ne…
CVE-2023-21317MEDIUMCVSS 5.5EG 5.5
2023-10-30
In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privil…
CVE-2023-21316MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges ne…
CVE-2023-21306MEDIUMCVSS 5.5EG 5.5
2023-10-30
In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interactio…
CVE-2023-21305MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges ne…
CVE-2023-21304MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privi…
CVE-2023-21303MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges nee…
CVE-2023-21302MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privi…
CVE-2023-21301MEDIUMCVSS 5.5EG 5.5
2023-10-30
In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional executi…
CVE-2023-21300MEDIUMCVSS 5.5EG 5.5
2023-10-30
In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privil…
CVE-2023-21299MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privi…
CVE-2023-21296MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privilege…
CVE-2023-21293MEDIUMCVSS 5.5EG 5.5
2023-10-30
In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution…
CVE-2022-20264MEDIUMCVSS 5.5EG 5.5
2023-10-30
In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution pr…
CVE-2022-42792MEDIUMCVSS 5.5EG 5.5
2023-06-23
This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive location information
CVE-2023-28200MEDIUMCVSS 5.5EG 5.5
2023-05-08
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to disclose kernel memory.
CVE-2023-27931MEDIUMCVSS 5.5EG 5.5
2023-05-08
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.3, tvOS 16.4, watchOS 9.4. An app may be able to access user-sensitive…
CVE-2022-4543MEDIUMCVSS 5.5EG 5.5
2023-01-11
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems.
CVE-2022-20538MEDIUMCVSS 5.5EG 5.5
2022-12-16
In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no addit…
CVE-2022-20531MEDIUMCVSS 5.5EG 5.5
2022-12-16
In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges ne…
CVE-2022-20324MEDIUMCVSS 5.5EG 5.5
2022-08-12
In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges …
CVE-2022-20304MEDIUMCVSS 5.5EG 5.5
2022-08-12
In Content, there is a possible way to determinate the user's account due to side channel information disclosure. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exp…
CVE-2022-20293MEDIUMCVSS 5.5EG 5.5
2022-08-12
In LauncherApps, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileg…
CVE-2022-20291MEDIUMCVSS 5.5EG 5.5
2022-08-12
In AppOpsService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privile…
CVE-2022-20279MEDIUMCVSS 5.5EG 5.5
2022-08-12
In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution p…
CVE-2022-20277MEDIUMCVSS 5.5EG 5.5
2022-08-12
In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution p…
CVE-2022-20276MEDIUMCVSS 5.5EG 5.5
2022-08-12
In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution p…
CVE-2022-20275MEDIUMCVSS 5.5EG 5.5
2022-08-12
In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution p…
CVE-2022-20242MEDIUMCVSS 5.5EG 5.5
2022-08-11
In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges …
CVE-2021-0975MEDIUMCVSS 5.5EG 5.5
2022-08-11
In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure of installed packages with no addition…
CVE-2021-33149MEDIUMCVSS 5.5EG 5.5
2022-05-12
Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVE-2021-39791MEDIUMCVSS 5.5EG 5.5
2022-03-30
In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional executi…
CVE-2021-39788MEDIUMCVSS 5.5EG 5.5
2022-03-30
In TelecomManager, there is a possible way to check if a particular self managed phone account was registered on the device due to side channel information disclosure. This could lead to local information disclosure with no additional exec…
CVE-2021-39775MEDIUMCVSS 5.5EG 5.5
2022-03-30
In People, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges nee…
CVE-2021-39773MEDIUMCVSS 5.5EG 5.5
2022-03-30
In VpnManagerService, there is a possible disclosure of installed VPN packages due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is …
CVE-2021-39766MEDIUMCVSS 5.5EG 5.5
2022-03-30
In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges n…
CVE-2021-39761MEDIUMCVSS 5.5EG 5.5
2022-03-30
In Media, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges need…
CVE-2021-39760MEDIUMCVSS 5.5EG 5.5
2022-03-30
In AudioService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileg…
CVE-2021-39756MEDIUMCVSS 5.5EG 5.5
2022-03-30
In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges …
CVE-2021-39755MEDIUMCVSS 5.5EG 5.5
2022-03-30
In DevicePolicyManager, there is a possible way to reveal the existence of an installed package without proper query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional…
CVE-2021-39754MEDIUMCVSS 5.5EG 5.5
2022-03-30
In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privilege…
CVE-2021-39745MEDIUMCVSS 5.5EG 5.5
2022-03-30
In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution p…
CVE-2021-39744MEDIUMCVSS 5.5EG 5.5
2022-03-30
In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution p…
CVE-2021-44421MEDIUMCVSS 5.5EG 5.5
2022-03-10
The pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a confused deputy that allows a local attacker to access unauthorized information via side-channel analysis.
CVE-2021-0524MEDIUMCVSS 5.5EG 5.5
2022-02-11
In isServiceDistractionOptimized of CarPackageManagerService.java, there is a possible disclosure of installed packages due to side channel information disclosure. This could lead to local information disclosure with no additional executio…
CVE-2021-1030MEDIUMCVSS 5.5EG 5.5
2021-12-15
In setNotificationsShownFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local info…
CVE-2021-1026MEDIUMCVSS 5.5EG 5.5
2021-12-15
In startRanging of RttServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additi…
CVE-2021-1014MEDIUMCVSS 5.5EG 5.5
2021-12-15
In getNetworkTypeForSubscriber of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information dis…

Map vulnerabilities like CWE-203 to your infrastructure

EchelonGraph correlates every CVE — across CWE-203 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →