Weaknesses of type CWE-524

72 results

Cache com Informações Sensíveis

A aplicação armazena dados sensíveis (senhas, tokens, PII) em cache sem proteção adequada, permitindo que um atacante com acesso ao sistema recupere essas informações. O risco é que o cache persista além da sessão ou seja acessível a outros usuários/processos.

Example

Um navegador cacheia credenciais de login em histórico ou localStorage sem criptografia; um servidor de aplicação mantém tokens JWT em cache em memória compartilhada; um browser salva respostas HTTP contendo dados pessoais em cache local onde outro usuário da máquina consegue ler.

How to mitigate

Nunca cachear dados sensíveis ou, se necessário, use criptografia forte e TTL (tempo de expiração) curto. Configure headers HTTP (Cache-Control: no-store, no-cache) para impedir cache de respostas com PII, e limpe cache na logout/fim de sessão. Em armazenamento local (localStorage/sessionStorage), evite sensíveis; use memória efêmera.

CVE-2026-25540MEDIUMMastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)EPSS 0.4%CVE-2026-93748HIGHhttp-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-staleEPSS 0.4%CVE-2026-89186MEDIUMmpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesEPSS 0.4%CVE-2026-9678MEDIUMundici vulnerable to cross-user information disclosure via shared cache whitespace bypassEPSS 0.4%CVE-2026-35193LOWPotential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewareEPSS 0.4%CVE-2025-64762HIGHauthkit-nextjs may let session cookies be cached in CDNsEPSS 0.4%CVE-2026-82755MEDIUMash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusionEPSS 0.4%CVE-2024-12314HIGHRapid Cache <= 1.2.3 - Unauthenticated Cache PoisoningEPSS 0.4%CVE-2026-6907LOWPotential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewareEPSS 0.4%CVE-2026-27205LOWFlask session does not add `Vary: Cookie` header when accessed in some waysEPSS 0.4%CVE-2024-49580MEDIUMIn JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosureEPSS 0.4%CVE-2025-57752MEDIUMNext.js Affected by Cache Key Confusion for Image Optimization API RoutesEPSS 0.3%CVE-2026-41841MEDIUMSpring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxEPSS 0.3%CVE-2026-64648MEDIUMNext.js: Response Body Cache Confusion for Requests Containing BodiesEPSS 0.3%CVE-2026-15743MEDIUMCatalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheableEPSS 0.3%CVE-2026-40012MEDIUMInformation about ECS zero scoped answers might leak to clients that use a specific ECSEPSS 0.3%CVE-2026-49858MEDIUMAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateEPSS 0.3%CVE-2025-69202MEDIUMaxios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary HeaderEPSS 0.3%CVE-2026-14643MEDIUMundici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesEPSS 0.3%CVE-2026-71316HIGHNuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsEPSS 0.3%