CWE-525 — Use of Web Browser Cache Containing Sensitive Information
CWE-525: Use of Web Browser Cache Containing Sensitive Information
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
Common consequences
- Confidentiality: Read Application Data
Mitigations
Architecture and Design — Protect information stored in cache.
Implementation — Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.
Architecture and Design — Do not store unnecessarily sensitive information in the cache.
Architecture and Design — Consider using encryption in the cache.
References
- CWE page: https://cwe.mitre.org/data/definitions/525.html
- CWE list: https://cwe.mitre.org/data/index.html