1234
Phase: Implementation
Use a restrictive caching policy for forms and web pages that potentially contain sensitive
information.
Phase: Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Phase: Architecture and Design
Consider using encryption in the cache.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 966 SFP Secondary Cluster: Other Exposures 888 2403
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
OWASP Top Ten 2004 A2 CWE More Specific Broken Access Control
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
Related Attack Patterns
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
CWE-526: Cleartext Storage of Sensitive Information in an Environment
Variable
Weakness ID : 526
Structure : Simple
Abstraction : Variant
Description
The product uses an environment variable to store unencrypted sensitive information.
Extended Description
Information stored in an environment variable can be accessible by other processes with the
execution context, including child processes that dependencies are executed in, or serverless
functions in cloud environments. An environment variable's contents can also be inserted into
messages, headers, log files, or other outputs. Often these other dependencies have no need to
use the environment variable in question. A weakness that discloses environment variables could
expose this information.
Relationships
CWE Version 4.14
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable