Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Adobe Experience Manager Servlets Post Information Leak

CVE-2016-0956 · published 10 years ago
Summary

A weakness in Adobe Experience Manager's Servlets Post component on certain versions allows an attacker to potentially access confidential data. This affects versions 5.6.1, 6.0.0, and 6.1.0. Update to the latest version to fix the issue.

What to do
  • Update apache org.apache.sling:org.apache.sling.servlets.post to version 2.3.8.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.sling:org.apache.sling.servlets.post <= 2.3.6
Fix: upgrade to 2.3.8
– apache sling All versions
cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*
– adobe experience_manager 5.6.1
6.0.0
6.1.0
cpe:2.3:a:adobe:experience_manager:5.6.1:*:*:*:*:*:*:*
Original advisory text
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
51% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published10 Feb 2016
Updated22 Sep 2026
First seen6 Mar 2026
Sources
GHSA-m27m-628v-xxp2 · GHSA
CVE-2016-0956 · NVD
Track software like this
Free during beta