Product UI does not Warn User of Unsafe Actions
Weakness ID: 356 (Weakness Base)Status: Incomplete
+ Description

Description Summary

The software's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.

Extended Description

Software systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.

+ Time of Introduction
  • Architecture and Design
  • Implementation
+ Applicable Platforms

Languages

All

+ Observed Examples
ReferenceDescription
CVE-1999-1055Product does not warn user when document contains certain dangerous functions or macros.
CVE-1999-0794Product does not warn user when document contains certain dangerous functions or macros.
CVE-2000-0277Product does not warn user when document contains certain dangerous functions or macros.
CVE-2000-0517Product does not warn user about a certificate if it has already been accepted for a different site. Possibly resultant.
CVE-2005-0602File extractor does not warn user it setuid/setgid files could be extracted. Overlaps privileges/permissions.
CVE-2000-0342E-mail client allows bypass of warning for dangerous attachments via a Windows .LNK file that refers to the attachment.
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class221Information Loss or Omission
Research Concepts (primary)1000
ChildOfCategoryCategory355User Interface Security Issues
Development Concepts (primary)699
+ Relationship Notes

Often resultant, e.g. in unhandled error conditions.

Can overlap privilege errors, conceptually at least.

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERProduct UI does not warn user of unsafe actions
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Relationship Notes, Taxonomy Mappings
2008-10-14CWE Content TeamMITREInternal
updated Description
Back to top