CVE-2006-1547highunder attackCWE-749

CVE-2006-1547

Published · Updated

Follow this CVE+ Monitor Apache Struts+ Monitor struts:struts

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.5epss 55%
from disclosure to weapon
Published on NVDMar 30
CISA KEV+5776d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
2 products
Red Hat Application Server 3AS · Red Hat Application Server v2 4AS
fix ↗
Action required by CISAfederal deadline: 2022-07-21

Apply updates per vendor instructions.

In short

Apache Struts allowed attackers to crash web applications by sending specially crafted form data that exploited how the framework handled file uploads, potentially accessing sensitive internal methods.

Technical detail

CVE-2006-1547 is a denial of service vulnerability in Struts ActionForm that permits remote attackers to invoke the public getMultipartRequestHandler method via malicious multipart/form-data parameter names, gaining unauthorized access to CommonsMultipartRequestHandler internals and BeanUtils reflection capabilities. The attack requires no authentication and impacts availability through resource exhaustion or exception triggering.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a