CVE-2006-1547 Apache Struts 1 ActionForm Denial-of-Service
Remote attackers can cause a denial of service in Apache Struts by sending a crafted multipart form that accesses internal handler methods.
- Exploited in the wild
- Since 21 Jan 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-1547?
CVE-2006-1547 is a high-severity denial of service vulnerability in Apache Struts, published on 30 Mar 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Weakness: CWE-749
Which versions are affected by CVE-2006-1547?
2 open source packages ship an affected version, including struts:struts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
struts:struts Maven | All versions | 1.2.9 |
struts:struts Maven | All versions | 1.2.9 |
Products include Apache Struts.
How do I fix CVE-2006-1547?
Upgrade struts:struts to 1.2.9 or later. US federal agencies must fix it by 21 Jul 2022.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2006-1547 being exploited?
Yes. Attackers have exploited CVE-2006-1547 in the wild since at least 21 Jan 2022.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-7qwv-cwgj-c8rj.