The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
View on MITREBrowsers often store information in a client-side cache, which can leave behind sensitive information for other users to find and exploit, such as passwords or credit card numbers. The locations at most risk include public terminals, such as those in libraries and Internet cafes.
Protect information stored in cache.
Use a restrictive caching policy for forms and web pages that potentially contain sensitive information.
Do not store unnecessarily sensitive information in the cache.
Consider using encryption in the cache.
No detection method information available for this CWE.
No examples or observed CVEs available for this CWE.
CWE-525: Use of Web Browser Cache Containing Sensitive Information is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
If exploited, CWE-525 (Use of Web Browser Cache Containing Sensitive Information) it can compromise Confidentiality, leading to outcomes such as Read Application Data.
Recommended mitigations for CWE-525 include: Protect information stored in cache. Use a restrictive caching policy for forms and web pages that potentially contain sensitive information. Do not store unnecessarily sensitive information in the cache.
A CWE (Common Weakness Enumeration) like CWE-525 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.