CWE-208
AllowedObservable Timing Discrepancy
Abstraction: Base · Status: Incomplete
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
367 vulnerabilities reference this CWE, most recent first.
GHSA-92VC-67Q9-382J
Vulnerability from github – Published: 2026-08-25 03:32 – Updated: 2026-08-25 03:32The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting, an attacker could in principle send repeated token guesses against a known username and use the timing differences to attempt to recover a valid token, though the vendor rates the practical exploitability as low and no end-to-end network exploit has been demonstrated.
{
"affected": [],
"aliases": [
"CVE-2026-72700"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T02:16:45Z",
"severity": "HIGH"
},
"details": "The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting, an attacker could in principle send repeated token guesses against a known username and use the timing differences to attempt to recover a valid token, though the vendor rates the practical exploitability as low and no end-to-end network exploit has been demonstrated.",
"id": "GHSA-92vc-67q9-382j",
"modified": "2026-08-25T03:32:09Z",
"published": "2026-08-25T03:32:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-x239-6jqx-5hjh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72700"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/grav-before-timing-attack-via-non-constant-time-token-comparison"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-944J-8CH6-RF6X
Vulnerability from github – Published: 2024-02-05 21:30 – Updated: 2026-02-27 20:57A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "m2crypto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.40.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-50781"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208",
"CWE-385"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-05T22:41:57Z",
"nvd_published_at": "2024-02-05T21:15:10Z",
"severity": "MODERATE"
},
"details": "A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.",
"id": "GHSA-944j-8ch6-rf6x",
"modified": "2026-02-27T20:57:08Z",
"published": "2024-02-05T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50781"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-50781"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254426"
},
{
"type": "PACKAGE",
"url": "https://gitlab.com/m2crypto/m2crypto"
},
{
"type": "WEB",
"url": "https://gitlab.com/m2crypto/m2crypto/-/issues/342"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657"
}
GHSA-94G3-G5V7-Q4JG
Vulnerability from github – Published: 2026-03-19 16:42 – Updated: 2026-05-08 15:18Impact
Those using AES in CBC mode may be susceptible to a padding oracle timing attack.
Patches
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788
Workarounds
Use AES in CTR, CFB or OFB modes
References
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.49"
},
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.50"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.51"
},
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.52"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.26"
},
"package": {
"ecosystem": "Packagist",
"name": "phpseclib/phpseclib"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.1"
},
{
"fixed": "1.0.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32935"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-19T16:42:18Z",
"nvd_published_at": "2026-03-20T03:16:00Z",
"severity": "HIGH"
},
"details": "### Impact\nThose using AES in CBC mode may be susceptible to a padding oracle timing attack.\n\n### Patches\nhttps://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788\n\n### Workarounds\nUse AES in CTR, CFB or OFB modes\n\n### References\nhttps://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788",
"id": "GHSA-94g3-g5v7-q4jg",
"modified": "2026-05-08T15:18:13Z",
"published": "2026-03-19T16:42:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/phpseclib/phpseclib/security/advisories/GHSA-94g3-g5v7-q4jg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32935"
},
{
"type": "WEB",
"url": "https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpseclib/phpseclib"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "phpseclib\u0027s AES-CBC unpadding susceptible to padding oracle timing attack"
}
GHSA-95C6-P277-P87G
Vulnerability from github – Published: 2026-01-21 22:27 – Updated: 2026-01-22 15:40Impact
Timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.
Affected: all users relying on verify_key() for API key authentication prior to the fix.
Patches
Yes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.
Workarounds
- Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied.
- Use rate limiting to reduce the feasibility of statistical timing attacks.
References
- CWE-208: Observable Timing Discrepancy
- Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77
- OWASP: https://owasp.org/www-community/attacks/Timing_attack
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "fastapi-api-key"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23996"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-21T22:27:39Z",
"nvd_published_at": "2026-01-21T23:15:53Z",
"severity": "LOW"
},
"details": "### Impact\nTiming side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.\n\nAffected: all users relying on verify_key() for API key authentication prior to the fix.\n\n### Patches\nYes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.\n\n### Workarounds\n- Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied.\n- Use rate limiting to reduce the feasibility of statistical timing attacks.\n\n### References\n- CWE-208: Observable Timing Discrepancy\n- Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77\n- OWASP: https://owasp.org/www-community/attacks/Timing_attack",
"id": "GHSA-95c6-p277-p87g",
"modified": "2026-01-22T15:40:29Z",
"published": "2026-01-21T22:27:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Athroniaeth/fastapi-api-key/security/advisories/GHSA-95c6-p277-p87g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23996"
},
{
"type": "WEB",
"url": "https://github.com/Athroniaeth/fastapi-api-key/commit/310b2c5c77305f38c63c0b917539a0344071dfd8"
},
{
"type": "PACKAGE",
"url": "https://github.com/Athroniaeth/fastapi-api-key"
},
{
"type": "WEB",
"url": "https://github.com/Athroniaeth/fastapi-api-key/releases/tag/1.1.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection"
}
GHSA-95QG-PCPR-8WR9
Vulnerability from github – Published: 2026-07-15 00:31 – Updated: 2026-07-15 00:31HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service.
{
"affected": [],
"aliases": [
"CVE-2026-21840"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T22:16:52Z",
"severity": "LOW"
},
"details": "HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service.",
"id": "GHSA-95qg-pcpr-8wr9",
"modified": "2026-07-15T00:31:40Z",
"published": "2026-07-15T00:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21840"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0132093"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-974V-C5M7-M9WC
Vulnerability from github – Published: 2024-04-25 18:30 – Updated: 2024-04-25 18:30A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
{
"affected": [],
"aliases": [
"CVE-2024-2467"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-25T17:15:49Z",
"severity": "MODERATE"
},
"details": "A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.",
"id": "GHSA-974v-c5m7-m9wc",
"modified": "2024-04-25T18:30:39Z",
"published": "2024-04-25T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2467"
},
{
"type": "WEB",
"url": "https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-2467"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269567"
},
{
"type": "WEB",
"url": "https://people.redhat.com/~hkario/marvin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-98Q5-3V5R-QVFH
Vulnerability from github – Published: 2026-07-15 12:32 – Updated: 2026-07-15 12:32Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.
{
"affected": [],
"aliases": [
"CVE-2026-56764"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-15T12:18:15Z",
"severity": "MODERATE"
},
"details": "Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.",
"id": "GHSA-98q5-3v5r-qvfh",
"modified": "2026-07-15T12:32:02Z",
"published": "2026-07-15T12:32:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56764"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9F3H-4XVQ-5R5Q
Vulnerability from github – Published: 2022-12-28 21:30 – Updated: 2023-01-06 21:30A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-4823"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-28T21:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.",
"id": "GHSA-9f3h-4xvq-5r5q",
"modified": "2023-01-06T21:30:42Z",
"published": "2022-12-28T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4823"
},
{
"type": "WEB",
"url": "https://github.com/instedd/nuntium/commit/77236f7fd71a0e2eefeea07f9866b069d612cf0d"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217002"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GMJ-V2M8-QFFV
Vulnerability from github – Published: 2024-12-29 09:30 – Updated: 2024-12-31 21:30GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
{
"affected": [],
"aliases": [
"CVE-2024-56738"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-29T07:15:06Z",
"severity": "MODERATE"
},
"details": "GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.",
"id": "GHSA-9gmj-v2m8-qffv",
"modified": "2024-12-31T21:30:45Z",
"published": "2024-12-29T09:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56738"
},
{
"type": "WEB",
"url": "https://savannah.gnu.org/bugs/?66603"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GRJ-J43M-MJQR
Vulnerability from github – Published: 2022-06-24 00:00 – Updated: 2022-12-05 23:37In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames.
Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.334"
},
{
"fixed": "2.356"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.332.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-34174"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-05T23:37:15Z",
"nvd_published_at": "2022-06-23T17:15:00Z",
"severity": "MODERATE"
},
"details": "In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames.\n\nLogin attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.",
"id": "GHSA-9grj-j43m-mjqr",
"modified": "2022-12-05T23:37:15Z",
"published": "2022-06-24T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/957ef5902f2e40b6358e6d10f12b26f9dbd2f75a"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Observable timing discrepancy allows determining username validity in Jenkins"
}
No mitigation information available for this CWE.
CAPEC-462: Cross-Domain Search Timing
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.
CAPEC-541: Application Fingerprinting
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.
CAPEC-580: System Footprinting
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.