Definition

MITRE’s description of CWE-524: The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Common consequences MITRE lists

  • Confidentiality: Read Application Data

Why it matters

If a private page is cached under a public key, the next visitor, or an attacker who requests the same URL, receives someone else’s data.

How to prevent it

  • Send Cache-Control: no-store or private on authenticated and personalized responses.
  • Configure shared caches to bypass or key on authentication, and to ignore path tricks such as an added static-file extension.
  • Test that a private response is never served from cache to a different user.

Guides on this site

Main subject · Guide

Prevent shared-cache poisoning and private-response deception

Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.

Practice

References

  1. CWE-524 in the MITRE CWE list (version 4.20)

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.