The vulnerability allows a user with access to the `_internal` index in Splunk Enterprise or Splunk Cloud Platform to view session cookies and response bodies that contain sensitive data. Because these files are stored in log files, the flaw can result in the disclosure of confidential information and potentially enable session hijacking or impersonation. This issue is classified as CWE‑532, which describes improper handling of sensitive information in logs.

Affected products include Splunk Enterprise versions earlier than 10.2.2 or 10.0.5, as well as Splunk Cloud Platform versions earlier than 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13. Only users with roles that grant read access to the `_internal` index are able to exploit the flaw.

The CVSS score of 7.5 indicates a high severity of information disclosure. While the EPSS score is not provided, the vulnerability is not listed in CISA KEV, suggesting no known public exploitation yet. The attack vector requires the attacker to possess a role with internal index access, which limits exploitation to authenticated users with sufficient privileges. Nevertheless, the potential to uncover session cookies and sensitive response bodies makes this a significant risk for organizations that tolerate broad internal log access.