UI Discrepancy for Security Feature

Opis

The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.

When the user interface does not properly reflect what the user asks of it, then it can lead the user into a false sense of security. For example, the user might check a box to enable a security option to enable encrypted communications, but the product does not actually enable the encryption. Alternately, the user might provide a "restrict ALL" access control rule, but the product only implements "restrict SOME".

Skutki

• Other

  Varies by Context

Przykłady podatności

• CVE-1999-1446 UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.

Słabość nadrzędna

• CWE-684 Incorrect Provision of Specified Functionality

Słabości podrzędne

• CWE-447 Unimplemented or Unsupported Feature in UI
• CWE-448 Obsolete Feature in UI
• CWE-449 The UI Performs the Wrong Action

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific

Uwagi

This entry is likely a loose composite that could be broken down into the different types of errors that cause the user interface to have incorrect interactions with the underlying security feature.