ClassIncompleteCWE-446

CWE-446: UI Discrepancy for Security Feature

Description

The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.

When the user interface does not properly reflect what the user asks of it, then it can lead the user into a false sense of security. For example, the user might check a box to enable a security option to enable encrypted communications, but the product does not actually enable the encryption. Alternately, the user might provide a restrict ALL access control rule, but the product only implements restrict SOME.

Abstraction: ClassAn abstract weakness, independent of any specific language or technology.
Likelihood of exploit: Not rated by MITRE
Status: Incomplete

Common consequences

Other
Varies by Context

Related weaknesses

Parent weaknesses

CWE-684Incorrect Provision of Specified Functionality

Child weaknesses

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Description

The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.