An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in another way.
In order to do so, the server should enforce HTTP headers that require the browser to revalidate (must-revalidate) the source on every request (not to cache it). Practically meaning that when a user is logged out, it should not be possible to browse back in the browser (unauthorized) and see the content that is meant to be restricted to the authenticated user.
What is the proper terminology and base CVSS score for a caching mechanism that allows the browser to cache authenticated content?
I suppose an acceptable CVSS score might be:
- CVSS Base Score: 4.0
- CVSS Severity: Medium
- CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N