Weakness (CWE)
CWE-525: Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
How to prevent it (4 mitigations)
-
Architecture and Design
Protect information stored in cache.
-
Implementation
Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.
-
Architecture and Design
Do not store unnecessarily sensitive information in the cache.
-
Architecture and Design
Consider using encryption in the cache.
Source: MITRE CWE-525
43 results · Feed
-
Unscored —
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Application…
-
Medium 5.8
Cache Manipulation Attack in Apache Traffic Control
When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. …
-
Medium —
Rack-Cache caches sensitive headers
The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.