CWE-525 (通过浏览器缓存导致的信息暴露) — Vulnerability Class 36

CWE-525 represents a critical information exposure weakness where web applications fail to implement appropriate caching policies for sensitive data. This vulnerability typically arises when developers neglect to configure HTTP headers that control browser storage behavior, allowing private information such as login credentials, financial details, or personal identifiers to persist in local cache files. Attackers exploit this by accessing shared or public computers, retrieving cached pages, or using forensic tools to extract residual data from disk storage. To mitigate this risk, developers must explicitly instruct browsers not to store sensitive content by setting specific cache-control headers, such as "no-store," "no-cache," and "must-revalidate." Additionally, implementing secure session management and ensuring proper logout procedures further reduces the likelihood of sensitive data lingering in browser memory, thereby protecting user privacy and maintaining application integrity against unauthorized access.