Use of Web Browser Cache Containing Sensitive Information
CWE-525
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Implementation: Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as no-cache in the Cache-Control header.
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
Latest Use of Web Browser Cache Containing Sensitive Information vulnerabilities
- 9.1 Critical severity
undici: Exposure of Sensitive Information to an Unauthorized Actor
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stor
- 7.8 High severity
LAPSWebUI: Use of Web Browser Cache Containing Sensitive Information
Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords.
- 7.5 High severity
AION: Use of Web Browser Cache Containing Sensitive Information
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.
- 7.5 High severity
AION: Use of Web Browser Cache Containing Sensitive Information
A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0.
- 7.7 High severity
nextjs-auth0: Use of Web Browser Cache Containing Sensitive Information
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three pr
- 7.5 High severity
Nomad server on Domino: Use of Web Browser Cache Containing Sensitive Information
HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.