CVE-2006-1547: Apache Struts 1 ActionForm Denial-of-Service Vulnerability
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Other sources
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/struts:strutsto a version that resolves this vulnerability.Fixed in 1.2.9
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1547?
CVE-2006-1547 has a severity rating of moderate, primarily related to denial of service vulnerabilities.
How do I fix CVE-2006-1547?
To fix CVE-2006-1547, upgrade Apache Struts to version 1.2.9 or later.
What versions of Apache Struts are affected by CVE-2006-1547?
CVE-2006-1547 affects Apache Struts versions prior to 1.2.9, including 1.2.7 and 1.2.8.
Is there a workaround for CVE-2006-1547?
A recommended workaround for CVE-2006-1547 is to validate and sanitize parameter names in multipart/form-data submissions.
What type of attack does CVE-2006-1547 facilitate?
CVE-2006-1547 facilitates denial of service attacks through manipulation of multipart/form-data encoded forms.