The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Allowed | B | 524 | Use of Cache Containing Sensitive Information |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 723 | OWASP Top Ten 2004 Category A2 - Broken Access Control |
| MemberOf | Prohibited | C | 724 | OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management |
| MemberOf | Prohibited | C | 966 | SFP Secondary Cluster: Other Exposures |
| MemberOf | Prohibited | C | 1348 | OWASP Top Ten 2021 Category A04:2021 - Insecure Design |
| MemberOf | Prohibited | C | 1403 | Comprehensive Categorization: Exposed Resource |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-328 | Read Application Data (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1348 | OWASP Top Ten 2021 Category A04:2021 - Insecure Design |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 966 | SFP Secondary Cluster: Other Exposures |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Confidentiality | N/A | Read Application Data | Browsers often store information in a client-side cache, which can leave behind sensitive information for other users to find and exploit, such as passwords or credit card numbers. The locations at most risk include public terminals, such as those in libraries and Internet cafes. |
Browsers often store information in a client-side cache, which can leave behind sensitive information for other users to find and exploit, such as passwords or credit card numbers. The locations at most risk include public terminals, such as those in libraries and Internet cafes.
Protect information stored in cache.
Use a restrictive caching policy for forms and web pages that potentially contain sensitive information.
Do not store unnecessarily sensitive information in the cache.
Consider using encryption in the cache.
N/A
| Reference | Description |
|---|
| Ordinality | Description |
|---|
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| OWASP Top Ten 2004 | A2 | CWE More Specific | Broken Access Control |
| OWASP Top Ten 2004 | A3 | CWE More Specific | Broken Authentication and Session Management |