CWE-525: Information Exposure Through Browser Caching
Information Exposure Through Browser Caching
Weakness ID: 525 (Weakness Variant)
Status: Incomplete
Description
Description Summary
For each web page, the application should have an appropriate caching policy specifying the extent to which the page and its form fields should be cached.
Time of Introduction
Implementation
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Browsers often store information in a client-side cache, which can
leave behind sensitive information for other users to find and exploit,
such as passwords or credit card numbers. The locations at most risk
include public terminals, such as those in libraries and Internet
cafes.
Potential Mitigations
Protect information stored in cache.
Phases: Architecture and Design; Implementation
Use a restrictive caching policy for forms and web pages that
potentially contain sensitive information.
Do not store unnecessarily sensitive information in the cache.
Description
