CAPEC-204

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Identify Application Cache] An adversary first identifies an application that utilizes a cache. This could either be a web application storing data in a browser cache, or an application running on a separate machine. The adversary examines the cache to determine file permissions and possible encryption.

      2 techniques

      • Use probing tools to look for application cache files on a machine.
      • Use a web application and determine if any sensitive information is stored in browser cache.

2. Experiment

   They probe what they found.

   2. [Attempt to Access Cache] Once the cache has been discovered, the adversary attempts to access the cached data. This often requires previous access to a machine hosting the target application.

      2 techniques

      • Use priviledge escalation to access cache files that might have strict privileges.
      • If the application cache is encrypted with weak encryption, attempt to understand the encryption technique and break the encryption.

3. Exploit

   They carry out the attack.

   3. [Lift Sensitive Data from Cache] After gaining access to cached data, an adversary looks for potentially sensitive information and stores it for malicious use. This sensitive data could possibly be used in follow-up attacks related to authentication or authorization.

      1 technique

      • Using a public computer, or gaining access to a victim's computer, examine browser cache to look for sensitive data left over from previous sessions.

Prerequisites

• The target application must store sensitive information in a cache.

• The cache must be inadequately protected against attacker access.

Resources required

• The attacker must be able to reach the target application's cache. This may require prior access to the machine on which the target application runs. If the cache is encrypted, the attacker would need sufficient computational resources to crack the encryption. With strong encryption schemes, doing this could be intractable, but weaker encryption schemes could allow an attacker with sufficient resources to read the file.

Weaknesses it exploits

• CWE-311 Missing Encryption of Sensitive Data
• CWE-524 Use of Cache Containing Sensitive Information
• CWE-1239 Improper Zeroization of Hardware Register
• CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information

Recent CVEs with these weaknesses

1. 6.3CVE-2026-1197432026-11-09

   pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-docume…

2. 3.7CVE-2026-53452026-11-06

   HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. Th…

3. 5.4CVE-2026-351102026-11-06

   HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in u…

4. 3.7CVE-2026-218492026-11-06

   HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://localhost:8000) instead of an encrypted (wss://) channel…

5. 5.9CVE-2026-1166302026-11-06

   undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be val…

6. 6.5CVE-2026-1204742026-11-06

   undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin targ…

7. 7.4CVE-2026-1165922026-11-06

   undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request…

8. 4.2CVE-2026-1157102026-11-03

   Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query resu…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-167 White Box Reverse Engineering

Can lead to

• CAPEC-560 Use of Known Domain Credentials

MITRE's words, unchanged: CAPEC-204 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.