When trace logging is enabled in Spring Cloud Config Server versions 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, and 5.0.0 through 5.0.2, sensitive information is logged in plain text. This exposure of sensitive data in logs is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The vulnerability has a CVSS v3.1 score of 4.4 (medium severity) with an attack vector of local (AV:L), low attack complexity, requiring high privileges, no user interaction, and impacts confidentiality only. The vendor advises upgrading to versions 3.1.14 or greater (Enterprise Support Only), 4.1.10 or greater (Enterprise Support Only), 4.2.7 or greater (Enterprise Support Only), 4.3.3 or greater, and 5.0.3 or greater respectively to address the issue.

The vulnerability allows sensitive information to be exposed in log files when trace logging is enabled, potentially leading to confidentiality breaches if unauthorized parties access these logs. The impact is limited to confidentiality; integrity and availability are not affected. Exploitation requires local access with high privileges, reducing the likelihood of remote exploitation.

The vendor recommends upgrading affected Spring Cloud Config Server versions to the specified fixed versions: 3.1.14 or later (Enterprise Support Only), 4.1.10 or later (Enterprise Support Only), 4.2.7 or later (Enterprise Support Only), 4.3.3 or later, and 5.0.3 or later. Since no official patch links or remediation level are provided, users should consult the vendor's official advisories for the latest remediation guidance. Until upgrades are applied, avoid enabling trace logging in production environments to prevent sensitive data exposure in logs.