Common Weakness Enumeration
CWE-525
AllowedUse of Web Browser Cache Containing Sensitive Information
Abstraction: Variant · Status: Incomplete
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
60 vulnerabilities reference this CWE, most recent first.
GHSA-5VQJ-7M73-9W2P
Vulnerability from github – Published: 2025-01-20 18:30 – Updated: 2025-01-20 18:30
VLAI
Details
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-22349"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-20T18:15:13Z",
"severity": "MODERATE"
},
"details": "IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.",
"id": "GHSA-5vqj-7m73-9w2p",
"modified": "2025-01-20T18:30:49Z",
"published": "2025-01-20T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22349"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7172750"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6533-FHR2-F38H
Vulnerability from github – Published: 2025-11-01 00:30 – Updated: 2025-11-15 02:24
VLAI
Summary
Liferay Portal and DXP use an incorrect cache-control header
Details
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.adaptive.media.web"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.52"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:com.liferay.portal.impl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "69.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-62276"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-03T20:26:09Z",
"nvd_published_at": "2025-11-01T00:15:33Z",
"severity": "MODERATE"
},
"details": "The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser\u0027s cache.",
"id": "GHSA-6533-fhr2-f38h",
"modified": "2025-11-15T02:24:27Z",
"published": "2025-11-01T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62276"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/36c080fc4522e46d69b5c3b4b9eb6aca5ff52699"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/9781b594cffcd23583a1a0f93746fd20e3eb55bd"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.atlassian.net/browse/LPE-17701"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62276"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Liferay Portal and DXP use an incorrect cache-control header"
}
GHSA-6JQF-XC4J-4QG4
Vulnerability from github – Published: 2025-09-15 18:31 – Updated: 2025-09-15 18:31
VLAI
Details
IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-36082"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T16:15:37Z",
"severity": "MODERATE"
},
"details": "IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.",
"id": "GHSA-6jqf-xc4j-4qg4",
"modified": "2025-09-15T18:31:06Z",
"published": "2025-09-15T18:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36082"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7244777"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6RCG-P8J5-6HQ6
Vulnerability from github – Published: 2024-07-19 03:30 – Updated: 2024-07-19 03:30
VLAI
Details
HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-30130"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T02:15:13Z",
"severity": "LOW"
},
"details": "HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.",
"id": "GHSA-6rcg-p8j5-6hq6",
"modified": "2024-07-19T03:30:53Z",
"published": "2024-07-19T03:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30130"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0114184"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6VGG-XHVH-38FF
Vulnerability from github – Published: 2026-06-12 18:30 – Updated: 2026-06-12 18:30
VLAI
Summary
nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store
Details
internal/api/mobile_bundle.go:62-66 sets only Content-Type: application/yaml. The Web-UI sibling at internal/web/handlers.go:1316-1321 sets Cache-Control: no-store, Pragma: no-cache, Expires: 0, X-Content-Type-Options: nosniff — and has a test asserting it. The API path was missed.
Affected
All released versions up to v0.3.0.
Threat model
The endpoint returns a freshly minted X25519 private key inline. Without no-store, any intermediary proxy or CDN that caches 200 OK YAML responses retains the private key for its cache TTL. Same applies to browser disk cache for direct API hits. Combined with the cross-tenant authz advisory (critical), even a corrected authz layer would still leak via cache after fix.
Suggested fix
Copy the four headers from the Web sibling:
w.Header().Set("Content-Type", "application/yaml; charset=utf-8")
w.Header().Set("Cache-Control", "no-store")
w.Header().Set("Pragma", "no-cache")
w.Header().Set("Expires", "0")
w.Header().Set("X-Content-Type-Options", "nosniff")
Mirrors internal/web/handlers.go:1316-1321. Add a parallel test to the existing web-side coverage.
Suggested patch
Verified locally: go vet, go test -race -count=1 ./..., golangci-lint v2.12 all clean.
diff --git a/internal/api/mobile_bundle.go b/internal/api/mobile_bundle.go
index fc09da0..73152eb 100644
--- a/internal/api/mobile_bundle.go
+++ b/internal/api/mobile_bundle.go
@@ -58,8 +58,15 @@ func (s *Server) handleMobileBundle(w http.ResponseWriter, r *http.Request) {
return
}
- // Return YAML bundle with proper content-type
+ // Return YAML bundle with proper content-type. The bundle inlines a
+ // freshly-minted X25519 private key, so suppress every layer of cache
+ // between server and operator (intermediate proxies/CDNs, browser disk
+ // cache). Mirrors the Web-UI sibling at internal/web/handlers.go.
w.Header().Set("Content-Type", "application/yaml; charset=utf-8")
+ w.Header().Set("Cache-Control", "no-store")
+ w.Header().Set("Pragma", "no-cache")
+ w.Header().Set("Expires", "0")
+ w.Header().Set("X-Content-Type-Options", "nosniff")
w.WriteHeader(http.StatusOK)
if _, err := w.Write(bundle); err != nil {
s.logger.Error("write mobile bundle response", "error", err)
diff --git a/internal/api/mobile_bundle_test.go b/internal/api/mobile_bundle_test.go
index dcb8cd9..da08b01 100644
--- a/internal/api/mobile_bundle_test.go
+++ b/internal/api/mobile_bundle_test.go
@@ -52,6 +52,19 @@ func TestHandleMobileBundle_Success(t *testing.T) {
t.Errorf("Content-Type = %q, want 'application/yaml; charset=utf-8'", ct)
}
+ // Bundle inlines a private key — every cache between server and operator
+ // must drop the response. Mirrors the Web-UI sibling's headers.
+ for header, want := range map[string]string{
+ "Cache-Control": "no-store",
+ "Pragma": "no-cache",
+ "Expires": "0",
+ "X-Content-Type-Options": "nosniff",
+ } {
+ if got := w.Header().Get(header); got != want {
+ t.Errorf("%s = %q, want %q", header, got, want)
+ }
+ }
+
// Verify body is valid YAML with expected keys
var yamlData map[string]interface{}
if err := yaml.Unmarshal(w.Body.Bytes(), &yamlData); err != nil {
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.3.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/juev/nebula-mesh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-12T18:30:09Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "`internal/api/mobile_bundle.go:62-66` sets only `Content-Type: application/yaml`. The Web-UI sibling at `internal/web/handlers.go:1316-1321` sets `Cache-Control: no-store`, `Pragma: no-cache`, `Expires: 0`, `X-Content-Type-Options: nosniff` \u2014 and has a test asserting it. The API path was missed.\n\n## Affected\nAll released versions up to v0.3.0.\n\n## Threat model\nThe endpoint returns a freshly minted X25519 private key inline. Without `no-store`, any intermediary proxy or CDN that caches `200 OK` YAML responses retains the private key for its cache TTL. Same applies to browser disk cache for direct API hits. Combined with the cross-tenant authz advisory (critical), even a corrected authz layer would still leak via cache after fix.\n\n## Suggested fix\nCopy the four headers from the Web sibling:\n\n```go\nw.Header().Set(\"Content-Type\", \"application/yaml; charset=utf-8\")\nw.Header().Set(\"Cache-Control\", \"no-store\")\nw.Header().Set(\"Pragma\", \"no-cache\")\nw.Header().Set(\"Expires\", \"0\")\nw.Header().Set(\"X-Content-Type-Options\", \"nosniff\")\n```\n\nMirrors `internal/web/handlers.go:1316-1321`. Add a parallel test to the existing web-side coverage.\n\n## Suggested patch\n\nVerified locally: `go vet`, `go test -race -count=1 ./...`, `golangci-lint v2.12` all clean.\n\n```diff\ndiff --git a/internal/api/mobile_bundle.go b/internal/api/mobile_bundle.go\nindex fc09da0..73152eb 100644\n--- a/internal/api/mobile_bundle.go\n+++ b/internal/api/mobile_bundle.go\n@@ -58,8 +58,15 @@ func (s *Server) handleMobileBundle(w http.ResponseWriter, r *http.Request) {\n \t\treturn\n \t}\n \n-\t// Return YAML bundle with proper content-type\n+\t// Return YAML bundle with proper content-type. The bundle inlines a\n+\t// freshly-minted X25519 private key, so suppress every layer of cache\n+\t// between server and operator (intermediate proxies/CDNs, browser disk\n+\t// cache). Mirrors the Web-UI sibling at internal/web/handlers.go.\n \tw.Header().Set(\"Content-Type\", \"application/yaml; charset=utf-8\")\n+\tw.Header().Set(\"Cache-Control\", \"no-store\")\n+\tw.Header().Set(\"Pragma\", \"no-cache\")\n+\tw.Header().Set(\"Expires\", \"0\")\n+\tw.Header().Set(\"X-Content-Type-Options\", \"nosniff\")\n \tw.WriteHeader(http.StatusOK)\n \tif _, err := w.Write(bundle); err != nil {\n \t\ts.logger.Error(\"write mobile bundle response\", \"error\", err)\ndiff --git a/internal/api/mobile_bundle_test.go b/internal/api/mobile_bundle_test.go\nindex dcb8cd9..da08b01 100644\n--- a/internal/api/mobile_bundle_test.go\n+++ b/internal/api/mobile_bundle_test.go\n@@ -52,6 +52,19 @@ func TestHandleMobileBundle_Success(t *testing.T) {\n \t\tt.Errorf(\"Content-Type = %q, want \u0027application/yaml; charset=utf-8\u0027\", ct)\n \t}\n \n+\t// Bundle inlines a private key \u2014 every cache between server and operator\n+\t// must drop the response. Mirrors the Web-UI sibling\u0027s headers.\n+\tfor header, want := range map[string]string{\n+\t\t\"Cache-Control\": \"no-store\",\n+\t\t\"Pragma\": \"no-cache\",\n+\t\t\"Expires\": \"0\",\n+\t\t\"X-Content-Type-Options\": \"nosniff\",\n+\t} {\n+\t\tif got := w.Header().Get(header); got != want {\n+\t\t\tt.Errorf(\"%s = %q, want %q\", header, got, want)\n+\t\t}\n+\t}\n+\n \t// Verify body is valid YAML with expected keys\n \tvar yamlData map[string]interface{}\n \tif err := yaml.Unmarshal(w.Body.Bytes(), \u0026yamlData); err != nil {\n```",
"id": "GHSA-6vgg-xhvh-38ff",
"modified": "2026-06-12T18:30:09Z",
"published": "2026-06-12T18:30:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/juev/nebula-mesh/security/advisories/GHSA-6vgg-xhvh-38ff"
},
{
"type": "WEB",
"url": "https://github.com/forgekeep/nebula-mesh/commit/c13d5b2c013b4b323bc0c87a6ecc6afba6384ee5"
},
{
"type": "PACKAGE",
"url": "https://github.com/juev/nebula-mesh"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store"
}
GHSA-7RFJ-FX9J-89G3
Vulnerability from github – Published: 2026-01-19 18:30 – Updated: 2026-01-19 18:30
VLAI
Details
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-52659"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-19T18:16:03Z",
"severity": "LOW"
},
"details": "HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.",
"id": "GHSA-7rfj-fx9j-89g3",
"modified": "2026-01-19T18:30:27Z",
"published": "2026-01-19T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52659"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b\u0026searchTerm=kb0127995#"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9MHG-763P-R87W
Vulnerability from github – Published: 2025-04-10 15:31 – Updated: 2025-04-10 15:31
VLAI
Details
IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-43035"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-10T14:15:25Z",
"severity": "MODERATE"
},
"details": "IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.",
"id": "GHSA-9mhg-763p-r87w",
"modified": "2025-04-10T15:31:48Z",
"published": "2025-04-10T15:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43035"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7230561"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V7R-QG2V-5VFC
Vulnerability from github – Published: 2024-06-13 15:30 – Updated: 2024-06-13 15:30
VLAI
Details
IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 279973.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-22333"
],
"database_specific": {
"cwe_ids": [
"CWE-525",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-13T14:15:11Z",
"severity": "MODERATE"
},
"details": "IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 279973.",
"id": "GHSA-9v7r-qg2v-5vfc",
"modified": "2024-06-13T15:30:36Z",
"published": "2024-06-13T15:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22333"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279973"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7157256"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7157257"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9XPJ-62MM-24H2
Vulnerability from github – Published: 2024-06-14 09:31 – Updated: 2025-01-21 17:57
VLAI
Summary
Apache Airflow does not return the "Cache-Control" header for dynamic content
Details
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.
Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.
This issue affects Apache Airflow: before 2.9.2.
Users are recommended to upgrade to version 2.9.2, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-25142"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:24:09Z",
"nvd_published_at": "2024-06-14T09:15:09Z",
"severity": "LOW"
},
"details": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.\u00a0\n\nAirflow did not return \"Cache-Control\" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.\n\nThis issue affects Apache Airflow: before 2.9.2.\n\nUsers are recommended to upgrade to version 2.9.2, which fixes the issue.\n\n",
"id": "GHSA-9xpj-62mm-24h2",
"modified": "2025-01-21T17:57:43Z",
"published": "2024-06-14T09:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25142"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/39550"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/94eb647de692a4d9555b02dce85974da5d4c04e3"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-195.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/06/13/1"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Apache Airflow does not return the \"Cache-Control\" header for dynamic content"
}
GHSA-C2M5-HW39-3H7R
Vulnerability from github – Published: 2024-02-29 03:33 – Updated: 2024-02-29 03:33
VLAI
Details
IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 248947.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-27545"
],
"database_specific": {
"cwe_ids": [
"CWE-525"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T02:15:08Z",
"severity": "MODERATE"
},
"details": "IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 248947.",
"id": "GHSA-c2m5-hw39-3h7r",
"modified": "2024-02-29T03:33:18Z",
"published": "2024-02-29T03:33:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27545"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/248947"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6965446"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Protect information stored in cache.
Mitigation
Implementation
Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.
Mitigation
Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Mitigation
Architecture and Design
Consider using encryption in the cache.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.