CVE-2006-1547

apache struts

Published 30 Mar 2006 · updated 16 Jun 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 21 Jan 2022, with a remediation deadline of 21 Jul 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

References

issues.apache.org/bugzilla/show_bug.cgi?id=38534 · Issue Tracking, Permissions Required
lists.suse.com/archive/suse-security-announce/2006-May/0004.html · Broken Link
secunia.com/advisories/19493 · Broken Link
secunia.com/advisories/20117 · Broken Link
securitytracker.com/id?1015856 · Broken Link, Third Party Advisory, VDB Entry
struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html · Broken Link, Exploit, Patch
www.securityfocus.com/bid/17342 · Broken Link, Third Party Advisory, VDB Entry
www.vupen.com/english/advisories/2006/1205 · Broken Link
exchange.xforce.ibmcloud.com/vulnerabilities/25613 · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547 · US Government Resource