Falhas do tipo CWE-524
92 resultadosArmazenamento de Informações Sensíveis em Cache
A aplicação armazena dados sensíveis (senhas, tokens, chaves, dados pessoais) em cache sem proteção adequada. Um atacante com acesso ao sistema de arquivos, memória ou cache compartilhado consegue recuperar essas informações, comprometendo contas e dados.
Exemplo
Um navegador cachea credenciais de login em texto plano no disco, ou uma API armazena tokens JWT no Redis compartilhado sem criptografia. Qualquer processo ou usuário com acesso ao cache extrai os dados sensíveis.
Como mitigar
Nunca cachear dados sensíveis, ou cacheá-los criptografados com chaves gerenciadas de forma segura. Use marcadores HTTP (Cache-Control: no-store, no-cache) e configure TTL agressivo. Limpe o cache ao fazer logout ou destruir sessões.
CVE-2026-61836HIGHDirectus: Authorization-dependent response served from unsegmented cache keyEPSS 0.5%CVE-2026-35172HIGHDistribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationEPSS 0.5%CVE-2025-9901MEDIUMLibsoup: improper handling of http vary header in libsoup cachingEPSS 0.5%CVE-2026-113593LOWPotential exposure of private data via empty and missing Vary headersEPSS 0.5%CVE-2026-108088HIGHApache Cocoon: Cross-user cache poisoningEPSS 0.5%CVE-2026-40012MEDIUMInformation about ECS zero scoped answers might leak to clients that use a specific ECSEPSS 0.5%CVE-2026-53943CRITICALGhost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview headerEPSS 0.4%CVE-2023-45696MEDIUMHCL Sametime is impacted by an autocomplete enabled vulnerabilityEPSS 0.4%CVE-2026-25540MEDIUMMastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)EPSS 0.4%CVE-2026-48588LOWPotential exposure of private data via cached Set-Cookie responseEPSS 0.4%CVE-2026-50170HIGHAngular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheEPSS 0.4%CVE-2026-64792HIGHJoomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensionsEPSS 0.4%CVE-2026-111464MEDIUMWP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php ResponseEPSS 0.4%CVE-2026-65755HIGHJoomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extensionEPSS 0.4%CVE-2026-15743MEDIUMCatalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheableEPSS 0.4%CVE-2026-27205LOWFlask session does not add `Vary: Cookie` header when accessed in some waysEPSS 0.4%CVE-2026-14643MEDIUMundici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesEPSS 0.4%CVE-2025-64762HIGHauthkit-nextjs may let session cookies be cached in CDNsEPSS 0.4%CVE-2026-9678MEDIUMundici vulnerable to cross-user information disclosure via shared cache whitespace bypassEPSS 0.4%CVE-2026-59213LOWOpen WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)EPSS 0.4%