Log in Start free

Actively exploited · Published Mar 30, 2006 · Assigned by redhat

CVE-2006-1547

High 7.5 Exploited

In plain English

A high-severity security flaw in Struts 1 from Apache. Attackers are actively exploiting it in the wild (listed by CISA on January 21, 2022). The chance it is exploited in the next 30 days is estimated at 54.6% (higher than 99.0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)54.6%top 1.0% of all CVEs
Exploited in the wildYesCISA KEV since Jan 21, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jul 21, 2022.

Official description

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenstruts:struts1.2.9GHSA-7qwv-cwgj-c8rj

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References