CVE-2006-1547 KEV
7.5
HIGH · CVSS 3.1 · EPSS 54.6% (pctl 99)
Patch first
On CISA KEV — known exploited in the wild, due 2022-07-21.
Description
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Scoring
| CVSS | 7.5 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| EPSS | 54.64% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-749 |
| On CISA KEV | yes — remediate by 2022-07-21 |
| Public exploit | none known |
| Published | 2006-03-30 |
| Last modified | 2026-06-16 |
CISA KEV
| Name | Apache Struts 1 ActionForm Denial-of-Service Vulnerability |
|---|---|
| Added | 2022-01-21 |
| Due | 2022-07-21 |
| Vendor / product | Apache / Struts 1 |
| Ransomware use | none reported |
Affected (2)
| Vendor | Product |
|---|---|
| apache | commons beanutils |
| apache | struts |
References
- http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
- http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
- http://secunia.com/advisories/19493
- http://secunia.com/advisories/20117
- http://securitytracker.com/id?1015856
- http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
- http://www.securityfocus.com/bid/17342
- http://www.vupen.com/english/advisories/2006/1205
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
- http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
- http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
- http://secunia.com/advisories/19493
- http://secunia.com/advisories/20117
- http://securitytracker.com/id?1015856
- http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
- http://www.securityfocus.com/bid/17342
- http://www.vupen.com/english/advisories/2006/1205
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547
→ the Explorer · watch your stack · NVD