CVE-2016-0956 EXPLOIT
7.5
HIGH · CVSS 3.0 · EPSS 51.2% (pctl 99)
Patch early
A public exploit exists.
Description
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
Scoring
| CVSS | 7.5 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 51.15% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-200 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2016-02-10 |
| Last modified | 2026-06-17 |
Affected (5)
| Vendor | Product |
|---|---|
| adobe | experience manager |
| apache | sling |
| apple | mac os x |
| linux | linux kernel |
| microsoft | windows |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Apache Sling Framework (Adobe AEM) 2.3.6 - Information Disclosure | 2016-02-10 |
References
- http://packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2016/Feb/48
- http://www.securityfocus.com/archive/1/537498/100/0/threaded
- https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html
- https://www.exploit-db.com/exploits/39435/
- http://packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2016/Feb/48
- http://www.securityfocus.com/archive/1/537498/100/0/threaded
- https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html
- https://www.exploit-db.com/exploits/39435/
→ the Explorer · watch your stack · NVD