CVE-2016-0956 : The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

Published 2016-02-10 20:59:09

Updated 2018-10-09 19:58:58

Source Adobe Systems Incorporated

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2016-0956

Apache » Sling
cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*
Matching versions
Adobe » Experience Manager » Version: 6.1.0
cpe:2.3:a:adobe:experience_manager:6.1.0:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Linux » Linux Kernel
When used together with: Microsoft » Windows
Adobe » Experience Manager » Version: 6.0.0
cpe:2.3:a:adobe:experience_manager:6.0.0:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Linux » Linux Kernel
When used together with: Microsoft » Windows
Adobe » Experience Manager » Version: 5.6.1
cpe:2.3:a:adobe:experience_manager:5.6.1:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Linux » Linux Kernel
When used together with: Microsoft » Windows

Exploit prediction scoring system (EPSS) score for CVE-2016-0956

EPSS FAQ

2.95%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-0956

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	AV:N/AC:L/Au:N/C:C/I:N/A:N	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2016-0956

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-0956

http://www.securityfocus.com/archive/1/537498/100/0/threaded

SecurityFocus
http://seclists.org/fulldisclosure/2016/Feb/48

Full Disclosure: Apache Sling Framework v2.3.6 (Adobe AEM) [CVE-2016-0956] - Information Disclosure Vulnerability
http://packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html

Apache Sling Framework 2.3.6 Information Disclosure ≈ Packet Storm
https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html

Adobe Security Bulletin
Patch;Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/39435/

Apache Sling Framework (Adobe AEM) 2.3.6 - Information Disclosure

Jump to

Vulnerability Details : CVE-2016-0956

Products affected by CVE-2016-0956

Exploit prediction scoring system (EPSS) score for CVE-2016-0956

CVSS scores for CVE-2016-0956

CWE ids for CVE-2016-0956

References for CVE-2016-0956