879
CWE-356: Product UI does not Warn User of Unsafe Actions
Weakness ID : 356
Structure : Simple
Abstraction : Base
Description
The product's user interface does not warn the user before undertaking an unsafe action on behalf
of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
Extended Description
Product systems should warn users that a potentially dangerous action may occur if the user
proceeds. For example, if the user downloads a file from an unknown source and attempts to
execute the file on their machine, then the application's GUI can indicate that the file is unsafe.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 221 Information Loss or Omission 556
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 355 User Interface Security Issues 2320
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Non-Repudiation Hide Activities
Observed Examples
Reference Description
CVE-1999-1055 Product does not warn user when document contains certain dangerous
functions or macros.
https://www.cve.org/CVERecord?id=CVE-1999-1055
CVE-1999-0794 Product does not warn user when document contains certain dangerous
functions or macros.
https://www.cve.org/CVERecord?id=CVE-1999-0794
CVE-2000-0277 Product does not warn user when document contains certain dangerous
functions or macros.
https://www.cve.org/CVERecord?id=CVE-2000-0277
CVE-2000-0517 Product does not warn user about a certificate if it has already been accepted
for a different site. Possibly resultant.
https://www.cve.org/CVERecord?id=CVE-2000-0517
CVE-2005-0602 File extractor does not warn user if setuid/setgid files could be extracted.
Overlaps privileges/permissions.
https://www.cve.org/CVERecord?id=CVE-2005-0602
CVE-2000-0342 E-mail client allows bypass of warning for dangerous attachments via a
Windows .LNK file that refers to the attachment.
https://www.cve.org/CVERecord?id=CVE-2000-0342
CWE Version 4.14
CWE-357: Insufficient UI Warning of Dangerous Operations
CWE-357: Insufficient UI Warning of Dangerous Operations