Read Time:45 Second

Description

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-524

 

Consequences

Confidentiality: Read Application Data

Browsers often store information in a client-side cache, which can leave behind sensitive information for other users to find and exploit, such as passwords or credit card numbers. The locations at most risk include public terminals, such as those in libraries and Internet cafes.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Protect information stored in cache.

Phase: Architecture and Design, Implementation

Description: 

Use a restrictive caching policy for forms and web pages that potentially contain sensitive information.

Phase: Architecture and Design

Description: 

Do not store unnecessarily sensitive information in the cache.

Phase: Architecture and Design

Description: 

Consider using encryption in the cache.

CVE References