CVE-2016-0956 Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post
HighCVSS 7.5
EPSS 51.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.sling/org.apache.sling.servlets.post(Maven) | <= 2.3.6 | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | < 2.3.8 | 2.3.8 |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.0.2-incubator | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.0.4-incubator | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.1.0 | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.1.2 | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.2.0 | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.3.0 | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.3.2 | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.3.4 | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.3.6 | No fix listed |
| apache sling | All versions | No fix listed |
| Adobe experience manager | = 5.6.1 | No fix listed |
| Adobe experience manager | = 6.0.0 | No fix listed |
| Adobe experience manager | = 6.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- helpx.adobe.com patch vendor-advisory
- 39435 exploit
- packetstormsecurity.com exploit
- 20160210 Apache Sling Framework v2.3.6 (Adobe AEM) [CVE-2016-0956] - Information Disclosure Vulnerability mailing-list
- 20160210 Apache Sling Framework v2.3.6 - Information Disclosure Vulnerability mailing-list
- github.com