CVE-2006-1547
KEVApache Struts 1 ActionForm Denial-of-Service Vulnerability
Description
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HPublishedMar 30, 2006
Last modifiedJun 16, 2026
Added to KEVJan 21, 2022
Remediation dueJul 21, 2022
References
- issues.apache.org/bugzilla/show_bug.cgi?id=38534Issue TrackingPermissions Required
- lists.suse.com/archive/suse-security-announce/2006-May/0004.htmlBroken Link
- secunia.com/advisories/19493Broken Link
- secunia.com/advisories/20117Broken Link
- securitytracker.com/id?1015856Broken LinkThird Party Advisory
- struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.htmlBroken LinkExploit
- securityfocus.com/bid/17342Broken LinkThird Party Advisory
- vupen.com/english/advisories/2006/1205Broken Link
- exchange.xforce.ibmcloud.com/vulnerabilities/25613Third Party AdvisoryVDB Entry
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547US Government Resource
0 recent articles mention this CVE
73
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1559 days
- CVSS
- 7.5 HIGH
- EPSS (30-day exploit probability)
- 54.6% · top 1% of all CVEs
- Weakness
- NVD-CWE-Other
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.