⚠ Actively exploited
Added to CISA KEV on 2022-01-21. Federal agencies required to patch by 2022-07-21. Required action: Apply updates per vendor instructions..
CVE-2006-1547 — Exposed Dangerous Method or Function in Apache Struts
CWE-749 — Exposed Dangerous Method or FunctionCWE-20 — Improper Input Validation11 documents8 sources
Severity
7.5HIGHNVD
EPSS
15.4%
top 5.35%
CISA KEV
KEV
Added 2022-01-21
Due 2022-07-21
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMar 30
KEV addedJan 21
Latest updateMay 1
KEV dueJul 21
CISA Required Action: Apply updates per vendor instructions.
Description
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6