Web Cache Poisoning
High · Logic
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-444
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-444
Definition
Unkeyed inputs influence cached responses for other users.
Root cause
Cache keys omit sensitive headers/params.
Affected components
- Components in the “Logic” class
- Application / API handlers
- Supporting libraries
Impact
Stored XSS via cache, open redirects.
Severity
High · CVSS 8.2
Safe lab reproduction
PortSwigger cache poisoning
Detection methodology
Param/header cache tests.
Evidence examples
- Lab reproduction notes: PortSwigger cache poisoning
- Request/response excerpts (redacted)
- Detection signal: Param/header cache tests
Remediation
Include all inputs in cache key or disable cache.
Secure coding examples
Vary headers correctly; purge on deploy.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.