CWE-449The UI Performs the Wrong Action

Abstraction: Base · CVEs in our corpus: 14

The UI performs the wrong action with respect to the user's request.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): STIG ubuntu 22 04 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SI-10 Information Input Validation
AC-3 Access Enforcement
SA-8 Security and Privacy Engineering Principles

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

1 hardening rule · 1 OS baseline

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-36535`	5.7	7.1	0.0124	2023-08-08
`CVE-2023-39215`	5.7	7.1	0.0112	2023-09-12
`CVE-2023-43585`	5.5	7.1	0.0060	2023-12-13
`CVE-2023-39209`	4.8	5.9	0.0096	2023-08-08
`CVE-2025-26643`	4.5	5.4	0.0069	2025-03-07
`CVE-2025-56139`	4.4	5.3	0.0033	2025-09-03
`CVE-2024-24698`	4.0	4.9	0.0053	2024-02-14
`CVE-2024-49041`	3.9	4.3	0.0107	2024-12-06
`CVE-2025-21404`	3.9	4.3	0.0107	2025-02-06
`CVE-2024-38083`	3.7	4.3	0.0049	2024-06-13
`CVE-2024-43577`	3.7	4.3	0.0046	2024-10-18
`CVE-2025-49736`	3.7	4.3	0.0049	2025-08-12
`CVE-2025-13637`	3.5	4.3	0.0020	2025-12-02
`CVE-2023-43588`	3.3	3.5	0.0065	2023-11-15