The vulnerability permits an unauthenticated user to access diagnostic interfaces of Apache Cocoon, triggering cache operations and exposing verbose debugging logs and profile information. This is a CWE-497 vulnerability, allowing the attacker to retrieve sensitive system details that can assist in further attacks, making the primary impact information disclosure.

All releases of Apache Cocoon, produced by the Apache Software Foundation, are affected. The project has been retired and no updates or patches will be released, so every existing installation remains vulnerable.

The vulnerability does not allow code execution; its main risk is the leakage of confidential data through exposed diagnostic endpoints. The CVSS score is 7.5; EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the flaw remains unpatched and can be accessed without authentication, the risk is moderate to high in environments where the instance is reachable from untrusted networks. Restricting access or migrating to a supported product is advised.