CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.1)  
Search by ID:

CWE-525: Information Leak Through Browser Caching

Individual Definition in a New Window
Information Leak Through Browser Caching
Status: Incomplete
Weakness ID: 525 (Weakness Variant)
Description
Summary

For each web page, the application should have an appropriate caching policy specifying the extent to which the page and its form fields should be cached.

Potential Mitigations

Protect information stored in cache.

Do not store unnecessarily sensitive information in the cache.

Consider using encryption in the cache.

Other Notes

You should use a restrictive caching policy for forms and web pages that potentially contain sensitive information. The risk is that this information could be stored in a client-side cache (with most browsers) and left behind for other users to find. The most severe risk is for applications where the intended access is from public terminals, such as those in libraries and Internet cafes.

Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness VariantWeakness VariantWeakness Variant524Information Leak Through Caching
Development Concepts (primary)699
Research Concepts (primary)1000
ChildOfCategoryCategory723OWASP Top Ten 2004 Category A2 - Broken Access Control
Weaknesses in OWASP Top Ten (2004) (primary)711
ChildOfCategoryCategory724OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2004)711
Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
Anonymous Tool Vendor (under NDA)   
OWASP Top Ten 2004A2CWE More SpecificBroken Access Control
OWASP Top Ten 2004A3CWE More SpecificBroken Authentication and Session Management
Time of Introduction
* Implementation
Related Attack Patterns
CAPEC-ID(CAPEC Version 1.1)Attack Pattern Name
37Lifting Data Embedded in Client Distributions
Content History
Submissions
Anonymous Tool Vendor (under NDA). (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Potential_Mitigations, Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Relationships, Other_Notes, Taxonomy_Mappings
Back to top
Page Last Updated: November 24, 2008
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us