Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-07-21. Apply updates per vendor instructions.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
CVE-2006-1547: ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). (1.2.9 → 1.7)
Post summary
The text discloses that Apache Struts before version 1.2.9 with BeanUtils 1.7 is vulnerable to denial-of-service (CVE-2006-1547).
https://research.lyrie.ai/research/active-exploit-cve-2006-1547-struts-1 #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post announces that CVE‑2006‑1547, a Struts 1 vulnerability, is actively exploited in the wild and includes a PoC or exploit code, but does not mention a patch or mitigation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | commons_beanutils | 1.7.0 | - | - |
| App | apache | struts | - | - | - |