CVE-2006-1547: Apache Struts 1 ActionForm Denial-of-Service Vulnerability

Vulnerability summary

CVE-2006-1547 is a high (CVSS 7.8) Exposed Dangerous Method or Function vulnerability in Apache Struts 1. It is known to be exploited: CISA lists it, first on 21-01-2022. EPSS estimates a 54.63% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-03-2006
   PublishedVulnerability first disclosed.
2. 21-01-2022
   Added to CISA KEVApache Struts 1 ActionForm Denial-of-Service Vulnerability
3. 21-07-2022
   CISA remediation dueApply updates per vendor instructions.
4. 22-10-2025
   Last modifiedVulnerability information updated.

Description

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

• CWE-749Exposed Dangerous Method or FunctionThe product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.