CWE · MITRE source
CWE-524Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Applications may use caches to improve efficiency when communicating with remote entities or performing intensive calculations. A cache maintains a pool of objects, threads, connections, pages, financial data, passwords, or other resources to minimize the time it takes to initialize and access these resources. If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 6 mapping(s) from 3 framework(s): ATT&CK 4 (partial) · ASVS 5.0 1 (full) · CAPEC 1 (mostly)
NIST 800-53 r5 controls that address this weakness (1)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-21 | Information Refresh | SI | Refreshing cached data or generating it ephemerally and deleting afterward directly mitigates storage of sensitive information in caches. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-64762 | 7.0 | 9.1 | 0.0034 | 2025-11-21 |
CVE-2026-53943 | 7.0 | 9.6 | 0.0024 | 2026-06-24 |
CVE-2021-24027 | 5.5 | 7.5 | 0.0381 | 2021-04-06 |
CVE-2024-27917 UPD | 5.5 | 7.5 | 0.0061 | 2024-03-06 |
CVE-2024-45596 | 5.5 | 7.4 | 0.0062 | 2024-09-10 |
CVE-2024-12314 | 5.5 | 7.2 | 0.0033 | 2025-02-18 |
CVE-2026-35172 UPD | 5.5 | 7.5 | 0.0044 | 2026-04-06 |
CVE-2026-48901 UPD | 5.5 | 7.5 | 0.0024 | 2026-05-26 |
CVE-2026-46309 UPD | 5.5 | 7.0 | 0.0012 | 2026-06-08 |
CVE-2026-50170 UPD | 5.5 | 7.5 | 0.0027 | 2026-06-22 |
CVE-2026-13007 | 5.5 | 7.5 | 0.0043 | 2026-06-23 |
CVE-2019-9494 | 3.5 | 5.9 | 0.0374 | 2019-04-17 |
CVE-2019-9495 | 3.5 | 3.7 | 0.0345 | 2019-04-17 |
CVE-2019-11244 | 3.5 | 5.0 | 0.0048 | 2019-04-22 |
CVE-2019-14997 | 3.5 | 4.3 | 0.0117 | 2019-09-11 |
CVE-2022-3292 | 3.5 | 4.6 | 0.0049 | 2022-09-28 |
CVE-2022-32909 | 3.5 | 5.5 | 0.0022 | 2022-11-01 |
CVE-2021-44854 | 3.5 | 5.3 | 0.0061 | 2022-12-26 |
CVE-2023-37486 | 3.5 | 5.9 | 0.0043 | 2023-08-08 |
CVE-2023-45696 | 3.5 | 4.0 | 0.0044 | 2024-02-10 |
CVE-2024-0874 | 3.5 | 5.3 | 0.0076 | 2024-04-25 |
CVE-2024-33004 | 3.5 | 4.3 | 0.0024 | 2024-05-14 |
CVE-2024-41906 | 3.5 | 4.8 | 0.0023 | 2024-08-13 |
CVE-2024-49580 | 3.5 | 5.3 | 0.0034 | 2024-10-17 |
CVE-2025-5141 UPD | 3.5 | 5.5 | 0.0012 | 2025-06-17 |