CVE-2016-0956

HIGH

Apache Sling 2.3.6 - Info Disclosure

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-0956. PoCs published by Vulnerability-Lab.

AI-analyzed exploit summary This exploit demonstrates an information disclosure vulnerability in Apache Sling Framework v2.3.6 (Adobe AEM) by sending a crafted DELETE request to the SlingPostServlet, which responds with a 500 error containing a ChangeLog field that enumerates local system files/folders.

Description

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Vulnerability-Lab · textwebappsmultiple

https://www.exploit-db.com/exploits/39435

View Code ZIP pw:eip

This exploit demonstrates an information disclosure vulnerability in Apache Sling Framework v2.3.6 (Adobe AEM) by sending a crafted DELETE request to the SlingPostServlet, which responds with a 500 error containing a ChangeLog field that enumerates local system files/folders.

Classification

Working Poc 100%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Apache Sling Framework v2.3.6 (Adobe AEM)

No auth needed

Prerequisites: Access to a vulnerable Apache Sling Framework or Adobe AEM instance

MITRE ATT&CK

T1083 - File and Directory Discovery

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Core References

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2016/Feb/48

Patch, Vendor Advisory x_refsource_confirm

https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/537498/100/0/threaded

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/39435/

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html

Scores

CVSS v3 7.5

EPSS 0.1328

EPSS Percentile 94.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (5)

adobe/experience_manager 5.6.1

adobe/experience_manager 6.0.0

adobe/experience_manager 6.1.0

apache/sling

org.apache.sling/org.apache.sling.servlets.post 0 - 2.3.8Maven

Published Feb 10, 2016

Tracked Since Feb 18, 2026