CWEweakness
CWE-446 UI Discrepancy for Security Feature
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.
Common consequences
• Other: Varies by Context, Unexpected State, Bypass Protection Mechanism — When the user interface does not properly reflect what the user asks of it, then it can lead the user into a false sense of security.
Observed examples
• CVE-1999-1446: UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.
Related
Observed example · CVE (1)
- CVE-1999-1446 Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and… vulnerability
Child of · CWE (1)
- CWE-684 Incorrect Provision of Specified Functionality weakness
Referenced by CVE · weakness (3)
- CVE-2025-8353 UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a… vulnerability
- CVE-2025-52983 A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based,… vulnerability
- CVE-2023-1768 Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the… vulnerability