CVE-2006-1546: apache struts

EPSS trend

Probability

6.29%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.29% on 19-09-2026

19-09-202619-10-2026

EPSS score

6.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

15 links

mail-archives.apache.org/mod_mbox/…Mailing ListX Refsource MLISTWEB
securitytracker.com/id?1015856VDB EntryX Refsource SECTRACKWEB
struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.htmlX Refsource CONFIRMWEB
www.vupen.com/english/advisories/2006/1205VDB EntryX Refsource VUPENWEB
www.securityfocus.com/bid/17342VDB EntryX Refsource BIDWEB
issues.apache.org/bugzilla/show_bug.cgi?id=38374X Refsource CONFIRMWEB
secunia.com/advisories/19493Third Party AdvisoryX Refsource SECUNIAWEB
exchange.xforce.ibmcloud.com/vulnerabilities/25612VDB EntryX Refsource XFWEB
lists.suse.com/archive/suse-security-announce/2006-May/0004.htmlVendor AdvisoryX Refsource SUSEWEB
secunia.com/advisories/20117Third Party AdvisoryX Refsource SECUNIAWEB

Show all 15 references

mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%3cdr169r%24623%242%40sea.gmane.org%3eMailing ListX Refsource MLISTWEB
nvd.nist.gov/vuln/detail/CVE-2006-1546Advisory
github.com/apache/strutsPACKAGE
mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%3cdr169r$623$2@sea.gmane.org%3eWEB
mail-archives.apache.org/mod_mbox/…WEB

Related vulnerabilities

CVE-2018-1327apache software foundationapache struts+28.65%8y ago27-03-2018 21:00The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.CVE-2018-11776apache software foundationapache struts+9KEV99.99%8y ago22-08-2018 13:00Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.CVE-2013-2134apachestruts+270.21%13y ago16-07-2013 18:00Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.CVE-2013-2115apachestruts+274.64%13y ago10-07-2013 19:00Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.CVE-2013-2251apachearchiva+4KEV100.00%13y ago18-07-2013 01:00Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.CVE-2013-2135apachestruts+213.83%13y ago16-07-2013 18:00Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

All vulnerabilities instruts

CVE-2006-1546: apache struts

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References