CVE-2006-1546: High severity apache struts vulnerability
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1546?
CVE-2006-1546 has a medium severity rating due to the potential for remote attackers to bypass validation.
How do I fix CVE-2006-1546?
To fix CVE-2006-1546, upgrade Apache Struts to version 1.2.9 or later.
What versions of Apache Struts are affected by CVE-2006-1546?
CVE-2006-1546 affects all versions of Apache Struts prior to 1.2.9.
What attack vector does CVE-2006-1546 exploit?
CVE-2006-1546 allows exploitation through crafted requests containing 'org.apache.struts.taglib.html.Constants.CANCEL' parameters.
Are there any recommended mitigations for CVE-2006-1546?
Recommended mitigations for CVE-2006-1546 include applying input validation and upgrading to a patched version of Struts.