Use of Cache Containing Sensitive Information

Incomplete Base
Structure: Simple
Description

This vulnerability occurs when an application stores sensitive data in a cache that is accessible to unauthorized users or external systems.

Extended Description

Caches are used to boost performance by temporarily storing resources like database connections, session data, passwords, or computed results. However, if this cache is misconfigured or placed in an insecure location—such as a shared memory space or an externally readable directory—attackers can directly access it and steal the sensitive information it contains. Managing this at scale is difficult; an ASPM like Plexicus can help you track and remediate these flaws across your entire stack. While SAST tools can detect insecure cache configurations, Plexicus uses AI to analyze context and suggest specific, actionable fixes—such as implementing proper access controls or moving the cache to a secure, isolated location—saving hours of manual investigation and repair work.

Common Consequences 1
Scope: Confidentiality

Impact: Read Application Data

Detection Methods 1
Automated Static AnalysisHigh
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Potential Mitigations 3
Phase: Architecture and Design
Protect information stored in cache.
Phase: Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Phase: Architecture and Design
Consider using encryption in the cache.
Modes of Introduction
Implementation
Related Attack Patterns