The issue lets sensitive request or response data be written to application logs when Spring Cloud Function runs on Azure. The default logger configuration captures payloads without filtering, so confidential values can appear verbatim in trace logs, enabling anyone with log access to read data that should remain private.

Versions 5.0.0 through 5.0.3, 4.3.0 through 4.3.4, and 4.2.0 through 4.2.7 of Spring Cloud Function are affected. Deployments on Microsoft Azure that use these releases should evaluate whether their logging settings capture request or response content that contains sensitive information.

The CVSS score of 3.1 indicates low to medium severity, and EPSS data is unavailable while the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of active exploitation. The attack vector is inferred to be any user who can invoke the function and read logs at a privileged level, which limits exposure to data that the application logs.