CWEweakness

CWE-357 Insufficient UI Warning of Dangerous Operations

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.

Common consequences

• Non-Repudiation: Hide Activities

Observed examples

• CVE-2007-1099: User not sufficiently warned if host key mismatch occurs

Related

Observed example · CVE (1)

  • CVE-2007-1099 dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow… vulnerability

Child of · CWE (1)

  • CWE-693 Protection Mechanism Failure weakness

Referenced by CVE · weakness (20)

  • CVE-2026-58597 Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over… vulnerability
  • CVE-2026-47782 Android App "RoboForm Password Manager" provided by Siber Systems, Inc. vulnerability
  • CVE-2026-26151 Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a… vulnerability
  • CVE-2025-47967 Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a… vulnerability
  • CVE-2025-33054 Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network. vulnerability
  • CVE-2025-49582 XWiki is a generic wiki platform. vulnerability
  • CVE-2025-49583 XWiki is a generic wiki platform. vulnerability
  • CVE-2025-49585 XWiki is a generic wiki platform. vulnerability
  • CVE-2025-49587 XWiki is an open-source wiki software platform. vulnerability
  • CVE-2024-49054 Microsoft Edge (Chromium-based) Spoofing Vulnerability vulnerability
  • CVE-2024-43580 Microsoft Edge (Chromium-based) Spoofing Vulnerability vulnerability
  • CVE-2024-43505 Microsoft Office Visio Remote Code Execution Vulnerability vulnerability
  • CVE-2024-30058 Microsoft Edge (Chromium-based) Spoofing Vulnerability vulnerability
  • CVE-2024-29057 Microsoft Edge (Chromium-based) Spoofing Vulnerability vulnerability
  • CVE-2024-26188 Microsoft Edge (Chromium-based) Spoofing Vulnerability vulnerability
  • CVE-2024-21336 Microsoft Edge (Chromium-based) Spoofing Vulnerability vulnerability
  • CVE-2024-21387 Microsoft Edge for Android Spoofing Vulnerability vulnerability
  • CVE-2022-41904 Element iOS is an iOS Matrix client provided by Element. vulnerability
  • CVE-2021-22645 Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to… vulnerability
  • CVE-2019-13521 A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and… vulnerability

Referenced by CWE · child of (1)

  • CWE-450 Multiple Interpretations of UI Input weakness