CVE-2006-1547

high-risk
Published 2006-03-30

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Do I need to act?

!
15.4% chance of exploitation in next 30 days
EPSS score — higher than 85% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Apache

References (19)

Broken Link http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
Broken Link http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
Broken Link http://secunia.com/advisories/19493
Broken Link http://secunia.com/advisories/20117
Broken Link http://securitytracker.com/id?1015856
Broken Link http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
Broken Link http://www.securityfocus.com/bid/17342
Broken Link http://www.vupen.com/english/advisories/2006/1205
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
Broken Link http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
Broken Link http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
Broken Link http://secunia.com/advisories/19493
Broken Link http://secunia.com/advisories/20117
Broken Link http://securitytracker.com/id?1015856
Broken Link http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
Broken Link http://www.securityfocus.com/bid/17342
Broken Link http://www.vupen.com/english/advisories/2006/1205
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-...
51
/ 100
high-risk
Severity 26/34 · High
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal