CVE-2006-1547
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
Yes
*KEV
Decision
-
*SSVC
Descriptions
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2006-03-30 CVE Reserved
- 2006-03-30 CVE Published
- 2022-01-21 Exploited in Wild
- 2022-07-21 KEV Due Date
- 2024-07-25 EPSS Updated
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
CWE
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://issues.apache.org/bugzilla/show_bug.cgi?id=38534 | Broken Link | |
| http://secunia.com/advisories/19493 | Broken Link | |
| http://secunia.com/advisories/20117 | Broken Link | |
| http://securitytracker.com/id?1015856 | Broken Link | |
| http://www.securityfocus.com/bid/17342 | Broken Link | |
| http://www.vupen.com/english/advisories/2006/1205 | Broken Link | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25613 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html | 2024-07-24 | |
| https://access.redhat.com/security/cve/CVE-2006-1547 | 2006-05-03 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1618045 | 2006-05-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Commons Beanutils Search vendor "Apache" for product "Commons Beanutils" | 1.7.0 Search vendor "Apache" for product "Commons Beanutils" and version "1.7.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | < 1.2.9 Search vendor "Apache" for product "Struts" and version " < 1.2.9" | - |
Affected
| ||||||