COMMON WEAKNESS ENUMERATIONIncomplete

CWE-446

UI Discrepancy for Security Feature

The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.

Soyutlama

Class

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.

Genişletilmiş açıklama

When the user interface does not properly reflect what the user asks of it, then it can lead the user into a false sense of security. For example, the user might check a box to enable a security option to enable encrypted communications, but the product does not actually enable the encryption. Alternately, the user might provide a "restrict ALL" access control rule, but the product only implements "restrict SOME".

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Varies by Context

Etkilenen güvenlik alanları: Other

Savunma

Nasıl önlenir ve çözülür?

  • Follow secure coding guidelines for input handling and boundary checking.
  • Enforce strict security reviews and automated static analysis (SAST) checks.