CWE-357 (对危险操作的UI警示不充分) — Vulnerability Class 19

CWE-357 represents a user interface weakness where warnings for dangerous or sensitive operations fail to capture the user’s attention effectively. This vulnerability typically arises when developers design alerts that are visually subtle, easily overlooked, or buried within complex workflows, leading users to inadvertently execute destructive actions like data deletion or privilege escalation. Attackers or malicious insiders exploit this by tricking users into confirming these operations, often through social engineering or by relying on the user’s inattention. To mitigate this risk, developers must ensure warnings are prominent, using high-contrast colors, distinct modal dialogs, or explicit confirmation steps that require active user engagement. By prioritizing clarity and urgency in interface design, organizations can significantly reduce the likelihood of accidental or coerced execution of critical system changes, thereby enhancing overall security posture and user trust.