UI Discrepancy for Security Feature

Incomplete Class
Structure: Simple
Description

This vulnerability occurs when a user interface incorrectly displays a security feature as active or properly configured, misleading users into believing they are protected when they are not.

Extended Description

This flaw creates a dangerous gap between what the user sees and what the system actually does. For example, a user might toggle a setting labeled "Enable end-to-end encryption" and see a visual confirmation, but the underlying software fails to activate the encryption layer. The interface provides a false positive, leaving data exposed during transmission. These discrepancies often stem from poor synchronization between the UI state and the backend security controls. Another common scenario is when a user sets an access control rule to "Deny All," but the system only implements a weaker "Deny Some" policy. This erodes trust and can lead directly to security breaches because users rely on visual feedback that does not match reality.

Common Consequences 1
Scope: Other

Impact: Varies by Context

Observed Examples 1
CVE-1999-1446UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Architecture and Design
Implementation
Taxonomy Mapping
  • PLOVER
Notes
MaintenanceThis entry is likely a loose composite that could be broken down into the different types of errors that cause the user interface to have incorrect interactions with the underlying security feature.