1233
Protect information stored in cache.
Phase: Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Phase: Architecture and Design
Consider using encryption in the cache.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 965 SFP Secondary Cluster: Insecure Session Management 888 2403
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Related Attack Patterns
CAPEC-ID Attack Pattern Name
204 Lifting Sensitive Data Embedded in Cache
CWE-525: Use of Web Browser Cache Containing Sensitive Information
Weakness ID : 525
Structure : Simple
Abstraction : Variant
Description
The web application does not use an appropriate caching policy that specifies the extent to which
each web page and associated form fields should be cached.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 524 Use of Cache Containing Sensitive Information 1232
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Browsers often store information in a client-side cache,
which can leave behind sensitive information for other
users to find and exploit, such as passwords or credit
card numbers. The locations at most risk include public
terminals, such as those in libraries and Internet cafes.
Potential Mitigations
Phase: Architecture and Design
Protect information stored in cache.
Phase: Architecture and Design
CWE Version 4.14
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable