Skip to main content

Use of Cache Containing Sensitive Information

CVE-2024-49580

Severity Medium
Score 5.3/10

Summary

In io.ktor:ktor-client-core-jvm versions prior to 2.3.13 and 3.x prior to 3.0.0-rc-2, improper caching in the 'HttpCache' plugin could lead to response information disclosure.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-524 - Use of Cache Containing Sensitive Information

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Advisory Timeline

  • Published