CVE-2006-1547

Name: CVE-2006-1547
Creator: NVD / NIST
Published: 2006-03-30T22:02:00+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10Actively ExploitedEPSS 54.63%

Last modified Jun 16, 2026

CVE-2006-1547 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.. CISA has confirmed active exploitation in the wild. EPSS estimates a 54.63% chance of exploitation in the next 30 days.

Description

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

54.63%

98.9th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Jul 21, 2022.

Weakness Enumeration

CWE-749

Affected Software

Vendor	Product	Versions
Apache	Struts	< 1.2.9

References

http://issues.apache.org/bugzilla/show_bug.cgi?id=38534Issue Tracking, Permissions Required
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.htmlBroken Link
http://secunia.com/advisories/19493Broken Link
http://secunia.com/advisories/20117Broken Link
http://securitytracker.com/id?1015856Broken Link, Third Party Advisory, VDB Entry
http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.htmlBroken Link, Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/17342Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2006/1205Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/25613Third Party Advisory, VDB Entry
http://issues.apache.org/bugzilla/show_bug.cgi?id=38534Issue Tracking, Permissions Required
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.htmlBroken Link
http://secunia.com/advisories/19493Broken Link
http://secunia.com/advisories/20117Broken Link
http://securitytracker.com/id?1015856Broken Link, Third Party Advisory, VDB Entry
http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.htmlBroken Link, Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/17342Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2006/1205Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/25613Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547US Government Resource

Timeline

Published: Mar 30, 2006
Last Modified: Jun 16, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2006-1547?

How severe is CVE-2006-1547?

CVE-2006-1547 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 54.63% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2006-1547?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2006-1547?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST