CWE-448 is a small but real design flaw. A UI function is obsolete, and the product does not warn the user.
Think of a settings page that still offers a protection option the engine no longer honors, or a command that used to work and now does nothing.
How it happens
Features age. The back end changes, a component is replaced, a setting is superseded. The UI keeps the old control because nobody removed it, and users keep trusting it.
What an attacker gains
MITRE lists the consequence as quality degradation, varying by context. The security angle appears when the obsolete control was a protective one. The user thinks it is working and it is not.
How to find it
The record has no detection methods and no observed CVEs. Review the UI against the current feature set. Walk every setting and menu item and ask whether it still does what its label says.
How to fix it
MITRE's mitigation, at the architecture and design phase, has two parts:
- Remove the obsolete feature from the UI.
- Warn the user that the feature is no longer supported.
Prefer removal. Where users depend on the control during a transition, show a clear notice at the point of use, not only in release notes.
Quick check
What are the two MITRE-listed fixes?
Remove the obsolete feature from the UI, and warn the user that the feature is no longer supported.
