Weakness (CWE)
CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
How to prevent it (3 mitigations)
-
Architecture and Design
Protect information stored in cache.
-
Architecture and Design
Do not store unnecessarily sensitive information in the cache.
-
Architecture and Design
Consider using encryption in the cache.
Source: MITRE CWE-524
2 results · Clear filters · Feed
-
Critical 9.1
Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same …
-
Critical 9.6
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the …