CWE-524: Use of Cache Containing Sensitive Information, page 2
Filter
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
What the weakness is: CWE-524 at MITRE
Related attack patterns (CAPEC): 1
- CAPEC-204 Lifting Sensitive Data Embedded in Cache Severity: Medium
The attack patterns MITRE's CAPEC relates to CWE-524, as MITRE names them. Credits.
Ask an AI about CWE-524
Show the prompt
Explain CWE-524: Use of Cache Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/524.html and https://cve.bz/cve/cwe/524?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2026-44457EPSS 0.2%
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a resul…
- 2.3CVE-2026-6907EPSS 0.4%
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being store…
- 3.1CVE-2026-22741EPSS 0.2%
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring …
- 7.5CVE-2026-35172EPSS 0.5%
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: tru…
- 5.7CVE-2025-14806EPSS 0.3%
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
- 2.3CVE-2026-27205EPSS 0.4%
Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Informa…
- 6.5CVE-2026-25540EPSS 0.4%
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoint…
- 5.3CVE-2026-24472EPSS 0.5%
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. …
- 5.5CVE-2025-69581EPSS 0.2%
An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all person…
- 6.0CVE-2025-69202EPSS 0.3%
Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization by…
- 2.4CVE-2025-43410EPSS 0.2%
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2. An attacker with physical access may be able to view deleted notes.
- 4.8CVE-2025-64696EPSS 0.1%
Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory. If exploited, application-specific files may be accessed from other malicious applications.
- 3.3CVE-2025-65681EPSS 0.2%
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session…
- 8.0CVE-2025-64762EPSS 0.4%
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-ca…
- 6.3CVE-2025-61598EPSS 0.3%
Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those respon…
- 5.9CVE-2025-9901EPSS 0.5%
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authenti…
- 6.2CVE-2025-57752EPSS 0.3%
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API ro…
- 5.5CVE-2025-5141EPSS 0.1%
A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2…
- 5.1CVE-2025-4233EPSS 0.2%
An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies.
- 7.5CVE-2023-37517EPSS 0.2%
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
- 3.2CVE-2024-30127EPSS 0.2%
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
- 3.2CVE-2023-37516EPSS 0.2%
Missing "no cache" headers in HCL Leap permits user directory information to be cached.
- 7.2CVE-2024-12314EPSS 0.4%
The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers in the cached data. This makes it possible for unauthenticated attackers to poiso…
- 5.3CVE-2024-49580EPSS 0.4%
In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure
- 6.5CVE-2024-45596EPSS 0.7%
Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query str…
- 6.3CVE-2024-41906EPSS 0.2%
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not properly handle cacheable HTTP responses in the web service. This could allow an attacker to read a…
- 4.3CVE-2024-33004EPSS 0.2%
SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache …
- 5.3CVE-2024-0874EPSS 0.8%
A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.
- 7.5CVE-2024-27917EPSS 0.6%
Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 40…
- 7.5CVE-2023-45696EPSS 0.4%
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
- 7.5CVE-2023-37486EPSS 0.5%
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high im…
- 5.3CVE-2021-44854EPSS 0.7%
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis.
- 5.5CVE-2022-32909EPSS 0.2%
The issue was addressed with improved handling of caches. This issue is fixed in iOS 16. An app may be able to access user-sensitive data.
- 4.6CVE-2022-3292EPSS 0.6%
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- 7.5CVE-2021-24027EPSS 3.8%
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.
- 4.3CVE-2019-14997EPSS 1.2%
The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a r…
- 5.0CVE-2019-11244EPSS 0.5%
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed a…
- 3.7CVE-2019-9495EPSS 3.5%
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to instal…
- 5.9CVE-2019-9494EPSS 3.9%
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel …