CWE-449 says it plainly: the UI performs the wrong action with respect to the user's request.
In a security product, the gap between request and result is more than an annoyance. The user believes a state exists that does not.
How it happens
The mapping from input to action breaks somewhere. MITRE's observed examples:
- CVE-2001-1387: a network firewall accidentally implemented one command line option as if it were another, possibly leading to a behavioral information leak.
- CVE-2001-0081: a command line option suppressed a user prompt but did not properly disable a feature, although the feature was disabled when the product prompted the user.
- CVE-2002-1977: a product did not time out according to the user's specification, leaving sensitive data available after it should have expired.
What an attacker gains
MITRE lists quality degradation, varying by context. In the timeout example, that meant sensitive data stayed reachable longer than the user intended.
How to find it
MITRE suggests manual analysis: perform extensive functionality testing of the UI, which should behave as specified. Cover every option and flag, including combinations, and check the resulting state, not the message shown.
How to fix it
The record lists no formal mitigations. Keep a written spec for each option, write a test per option, and fix mismatches before release. Pay extra attention to security-relevant options such as timeouts, access rules and prompts.
Quick check
What does the timeout example teach?
Honor what the user configured. If a timeout is set, the data must actually expire on schedule.
