CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2006-1547
High (7.5) in Apache Struts 1. In CISA KEV since 2022-01-21. EPSS 55% chance of exploitation in the next 30 days. Fixed in struts:struts 1.2.9.
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Severity
- EPSS
- 55% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-01-21, due 2022-07-21
- CWE
- CWE-749
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:struts
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7qwv-cwgj-c8rj | Maven | struts:struts | <1.2.9 | 1.2.9 |