Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post

HIGH 7.5CVE-2016-0956 · GHSA-m27m-628v-xxp2 · Published 10/02/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.sling:org.apache.sling.servlets.post Maven	`< 2.3.8`	`2.3.8`
experience manager adobe	`= 5.6.1= 6.0.0= 6.1.0`	No fix yet

Description

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

NVD description

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2016-0956 · ADVISORY
helpx.adobe.com/security/products/experience-manager/apsb16-05.html · WEB
exploit-db.com/exploits/39435 · WEB
packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html · WEB
seclists.org/fulldisclosure/2016/Feb/48 · WEB
securityfocus.com/archive/1/537498/100/0/threaded · WEB
exploit-db.com/exploits/39435

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free