Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-g1q5-zmdw-53fu
Vulnerability ID VCID-g1q5-zmdw-53fu
Aliases CVE-2006-1547
GHSA-7qwv-cwgj-c8rj
Summary Improper Input Validation in Apache Struts ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-749 Exposed Dangerous Method or Function
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
cvssv3.1 7.5 http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
generic_textual HIGH http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
ssvc Attend http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
cvssv3.1 7.5 http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
cvssv3.1 7.5 http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
generic_textual HIGH http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
ssvc Attend http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
epss 0.22192 https://api.first.org/data/v1/epss?cve=CVE-2006-1547
epss 0.22192 https://api.first.org/data/v1/epss?cve=CVE-2006-1547
epss 0.22192 https://api.first.org/data/v1/epss?cve=CVE-2006-1547
epss 0.22192 https://api.first.org/data/v1/epss?cve=CVE-2006-1547
cvssv3.1 7.5 http://secunia.com/advisories/19493
cvssv3.1 7.5 http://secunia.com/advisories/19493
generic_textual HIGH http://secunia.com/advisories/19493
ssvc Attend http://secunia.com/advisories/19493
cvssv3.1 7.5 http://secunia.com/advisories/20117
cvssv3.1 7.5 http://secunia.com/advisories/20117
generic_textual HIGH http://secunia.com/advisories/20117
ssvc Attend http://secunia.com/advisories/20117
cvssv3.1 7.5 http://securitytracker.com/id?1015856
cvssv3.1 7.5 http://securitytracker.com/id?1015856
generic_textual HIGH http://securitytracker.com/id?1015856
ssvc Attend http://securitytracker.com/id?1015856
cvssv3.1 7.5 https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
cvssv3.1 7.5 https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
generic_textual HIGH https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
ssvc Attend https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-7qwv-cwgj-c8rj
cvssv3.1 7.5 https://github.com/apache/struts
generic_textual HIGH https://github.com/apache/struts
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2006-1547
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2006-1547
cvssv3.1 7.5 http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
cvssv3.1 7.5 http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
generic_textual HIGH http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
ssvc Attend http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
cvssv3.1 7.5 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547
generic_textual HIGH https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547
cvssv3.1 7.5 http://www.securityfocus.com/bid/17342
ssvc Attend http://www.securityfocus.com/bid/17342
cvssv3.1 7.5 http://www.vupen.com/english/advisories/2006/1205
ssvc Attend http://www.vupen.com/english/advisories/2006/1205
Reference id Reference type URL
http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2006-1547.json
https://api.first.org/data/v1/epss?cve=CVE-2006-1547
http://secunia.com/advisories/19493
http://secunia.com/advisories/20117
http://securitytracker.com/id?1015856
https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
https://github.com/apache/struts
http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547
1618045 https://bugzilla.redhat.com/show_bug.cgi?id=1618045
CVE-2006-1547 https://nvd.nist.gov/vuln/detail/CVE-2006-1547
GHSA-7qwv-cwgj-c8rj https://github.com/advisories/GHSA-7qwv-cwgj-c8rj
RHSA-2006:0281 https://access.redhat.com/errata/RHSA-2006:0281
Data source KEV
Date added Jan. 21, 2022
Description ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
Required action Apply updates per vendor instructions.
Due date July 21, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2006-1547
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at http://secunia.com/advisories/19493
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://secunia.com/advisories/19493
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://secunia.com/advisories/19493
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://secunia.com/advisories/20117
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at http://secunia.com/advisories/20117
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://secunia.com/advisories/20117
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://securitytracker.com/id?1015856
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at http://securitytracker.com/id?1015856
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://securitytracker.com/id?1015856
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at https://exchange.xforce.ibmcloud.com/vulnerabilities/25613
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at https://github.com/apache/struts
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at https://nvd.nist.gov/vuln/detail/CVE-2006-1547
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H Found at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.securityfocus.com/bid/17342
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://www.securityfocus.com/bid/17342
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.vupen.com/english/advisories/2006/1205
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:35:54Z/ Found at http://www.vupen.com/english/advisories/2006/1205
Exploit Prediction Scoring System (EPSS)
Percentile 0.95908
EPSS Score 0.22192
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:42:19.181735+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/struts/struts/CVE-2006-1547.yml 38.6.0