CyberRota Analysis
AI-GeneratedThe vulnerability exists in http-cache-semantics versions up to 4.2.0, where improper validation of security-zeroed cache entries allows unauthenticated attackers to exploit client max-stale directives. This flaw enables attackers to retrieve cached responses, including sensitive session credentials, from other users. Organizations utilizing this library should prioritize remediation to protect user data and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.