Detailedseverity: MediumDraft
CAPEC-204Lifting Sensitive Data Embedded in Cache
Abstraction
Detailed
Status
Draft
Severity
Medium
Description
An adversary examines a target application's cache, or a browser cache, for sensitive information. Many applications that communicate with remote entities or which perform intensive calculations utilize caches to improve efficiency. However, if the application computes or receives sensitive information and the cache is not appropriately protected, an attacker can browse the cache and retrieve this information. This can result in the disclosure of sensitive information.
Related weaknesses· 4
MITRE ATT&CK crosswalk· 1
Related attack patterns· 2
Exploits4
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Zeroization of Hardware Registercwe-1239 | 100% | live |
| Weakness | Missing Encryption of Sensitive Datacwe-311 | 100% | live |
| Weakness | Exposure of Sensitive System Information Due to Uncleared Debug Informationcwe-1258 | 100% | live |
| Weakness | Use of Cache Containing Sensitive Informationcwe-524 | 100% | live |
Related to1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Technique | Data from Local Systemt1005 | 100% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.