The issue lets request or response data be written to application logs when Spring Cloud Function runs on Azure. It is a result of inappropriate logging behaviour that exposes sensitive data and logs potentially unnecessary information (CWE-532). The default logger configuration captures payloads without filtering, so confidential values can appear verbatim in trace logs, enabling anyone with log access to read data that should remain private.

Versions 5.0.0 through 5.0.3, 4.3.0 through 4.3.4, and 4.2.0 through 4.2.7 of Spring Cloud Function are affected. Deployments on Microsoft Azure that use these releases should evaluate whether their logging settings capture request or response content that contains sensitive information.

The CVSS score of 3.1 indicates low severity, and the EPSS score of < 1% indicates a very low likelihood of active exploitation; the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be any user who can invoke the function and read logs at a privileged level, which limits exposure to data the application logs.