Use of Cache Containing Sensitive Information
CWE-524
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
We track 29 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
Latest Use of Cache Containing Sensitive Information vulnerabilities
- 8.7 High severity
Kong Gateway Enterprise: Use of Cache Containing Sensitive Information
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another.
- 8.2 High severity
Kong Gateway Enterprise: Use of Cache Containing Sensitive Information
The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers.
- 8.3 High severity
Kong Gateway Enterprise: Use of Cache Containing Sensitive Information
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another.
- 8.2 High severity
Kong Gateway Enterprise: Use of Cache Containing Sensitive Information
The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another.
- 7.4 High severity
undici: Origin Validation Error
undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting on
- 7.5 High severity
Eclipse Vert.x: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and
- 7.5 High severity
Apache Cocoon: Use of Cache Containing Sensitive Information
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Ap
- 9.1 Critical severity
undici: Origin Validation Error
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original r
- 9.1 Critical severity
mcp-toolbox-sdk-python: Use of Cache Containing Sensitive Information
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same p
- 7.5 High severity
http-cache-semantics: Use of Cache Containing Sensitive Information
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same UR
- 8.2 High severity
undici: Exposure of Sensitive Information to an Unauthorized Actor
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie h
- 7.5 High severity
netty: Use of Cache Containing Sensitive Information
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a
- 7.5 High severity
nuxt: Use of Cache Containing Sensitive Information
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing
- 7.3 High severity
NeuVector: Exposure of Sensitive Information Through Data Queries
NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.
- 7.5 High severity
undici: Interpretation Conflict
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directiv
- 7.5 High severity
Articles Anywhere extension for Joomla: Use of Cache Containing Sensitive Information
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or
- 7.5 High severity
Articles Anywhere extension for Joomla: Use of Cache Containing Sensitive Information
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted o
- 8.6 High severity
directus: Use of Cache Containing Sensitive Information
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits auth
- 7.1 High severity
Cloud NGFW: Use of Cache Containing Sensitive Information
An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious l
- 9.6 Critical severity
Ghost: Use of Cache Containing Sensitive Information
Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the r
- 7.5 High severity
Tenable Identity Exposure: Missing Authentication for Critical Functionality
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated rem
- 7.5 High severity
angular: Use of Cache Containing Sensitive Information
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Renderin
- 7.0 High severity
Linux: Missing Release of Memory after Effective Lifetime
In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached
- 7.5 High severity
distribution: Improper Access Control
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. T
- 9.1 Critical severity
authkit-nextjs: Use of Cache Containing Sensitive Information
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In env
- 7.2 High severity
Rapid Cache: Use of Cache Containing Sensitive Information
The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers in the cached data. This makes it possible for unauthenticated attackers to poison the cache with cust
- 7.5 High severity
shopware: Use of Cache Containing Sensitive Information
Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cache
- 7.5 High severity
HCL Sametime: Use of Cache Containing Sensitive Information
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
- 7.5 High severity
SAP Commerce (OCC API): Use of Cache Containing Sensitive Information
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiali