目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1310 CNY

100%
コーヒーを一杯おごる

CWE-524 通过缓存导致的信息暴露 类漏洞列表 32

CWE-524 通过缓存导致的信息暴露 类弱点 32 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-524属于敏感信息泄露漏洞，指应用程序使用的缓存中存储了敏感数据，且该缓存可被非预期控制域的外部实体读取。攻击者通常通过利用缓存访问权限配置不当或共享内存机制，窃取密码、会话令牌或财务数据等机密信息。开发者应避免在缓存中存储敏感内容，或实施严格的访问控制、加密存储及定期清理策略，确保缓存数据仅限授权进程访问，从而防止信息泄露。

MITRE CWE 官方描述
CWE：CWE-524 使用包含敏感信息的缓存（Use of Cache Containing Sensitive Information） 英文：代码使用了包含敏感信息的缓存，但该缓存可被预期控制范围之外的实体读取。 应用程序可能使用缓存来提高与远程实体通信或执行密集计算时的效率。缓存维护着对象、线程、连接、页面、财务数据、密码或其他资源的池，以最小化初始化及访问这些资源所需的时间。如果缓存可被未授权实体访问，攻击者即可读取缓存并获取这些敏感信息。
常见影响 (1)
ConfidentialityRead Application Data
缓解措施 (3)
Architecture and DesignProtect information stored in cache.
Architecture and DesignDo not store unnecessarily sensitive information in the cache.
Architecture and DesignConsider using encryption in the cache.
CVE IDタイトルCVSS深刻度公開日
CVE-2026-32244 Discourse: Cached outdated summaries can leak removed content — discourse 5.3 Medium2026-05-19
CVE-2026-44457 Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage — hono 5.3 Medium2026-05-13
CVE-2026-6907 Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware — Django 4.3 Medium2026-05-05
CVE-2026-22741 Static resource cache poisoning in Spring MVC and WebFlux — Spring Framework 3.1 Low2026-04-29
CVE-2025-14806 IBM Planning Analytics Information Disclosure — Planning Analytics Local 5.7 Medium2026-03-17
CVE-2026-27205 Flask session does not add `Vary: Cookie` header when accessed in some ways — flask 7.5AIHighAI2026-02-21
CVE-2026-25540 Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) — mastodon 6.5 Medium2026-02-04
CVE-2026-24472 Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception — hono 5.3 Medium2026-01-27
CVE-2025-69202 axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header — axios-cache-interceptor 9.1 -2025-12-29
CVE-2025-64696 Brother iPrint&Scan 安全漏洞 — Android App "Brother iPrint&Scan" 6.2AIMediumAI2025-12-09
CVE-2025-64762 authkit-nextjs may let session cookies be cached in CDNs — authkit-nextjs 4.2 -2025-11-21
CVE-2025-61598 Discourse is missing Cache-Control response header on error responses — discourse 5.3AIMediumAI2025-10-28
CVE-2025-9901 Libsoup: improper handling of http vary header in libsoup caching — Red Hat Enterprise Linux 10 5.9 Medium2025-09-03
CVE-2025-57752 Next.js Affected by Cache Key Confusion for Image Optimization API Routes — next.js 6.2 Medium2025-08-29
CVE-2025-5141 Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache — Core Privileged Access Manager (BoKS) 5.5 Medium2025-06-17
CVE-2025-4233 Prisma Access Browser: Inappropriate implementation in Cache — Prisma Access Browser 7.5AIHighAI2025-06-12
CVE-2023-37517 HCL Domino Volt and Domino Leap are affected by missing "no cache" headers — HCL Domino Leap 3.2 Low2025-04-30
CVE-2023-37516 HCL Leap is affected by missing "no cache" headers — HCL Leap 3.2 Low2025-04-24
CVE-2024-30127 HCL Leap is affected by missing "no cache" headers — HCL Leap 3.2 Low2025-04-24
CVE-2024-12314 Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning — Rapid Cache 7.2 High2025-02-18
CVE-2024-49580 JetBrains Ktor framework 安全漏洞 — Ktor 5.3 Medium2024-10-17
CVE-2024-45596 Directus's session is cached for OpenID and OAuth2 if `redirect` is not used — directus 7.4 High2024-09-10
CVE-2024-41906 Siemens SINEC Traffic Analyzer 安全漏洞 — SINEC Traffic Analyzer 4.8 Medium2024-08-13
CVE-2024-33004 Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices) — SAP BusinessObjects Business Intelligence Platform (Webservices) 4.3 Medium2024-05-14
CVE-2024-0874 Coredns: cd bit response is cached and served later 5.3 Medium2024-04-25
CVE-2024-27917 Shopware's session is persistent in Cache for 404 pages — shopware 7.5 High2024-03-06
CVE-2023-37486 Information Disclosure vulnerability in SAP Commerce (OCC API) — SAP Commerce (OCC API) 5.9 Medium2023-08-08
CVE-2022-3292 Use of Cache Containing Sensitive Information in ikus060/rdiffweb — ikus060/rdiffweb 6.5 -2022-09-28
CVE-2021-24027 Facebook WhatsApp 安全漏洞 — WhatsApp Business for Android 7.5 -2021-04-06
CVE-2019-14997 Atlassian Jira 安全漏洞 — Jira 4.3 -2019-09-11

CWE-524（通过缓存导致的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 32 条 CVE 漏洞。