CVE-2006-1547: apache struts

csirt@kutim:~/threat-intel/cve/CVE-2006-1547

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 54,6%

Kerentanan Exposed Dangerous Method or Function pada apache struts. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 21 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Rincian

Terbit di NVD: 30 Maret 2006
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-749: Exposed Dangerous Method or Function
EPSS (30 hari): 54,6% peluang dieksploitasi; lebih tinggi dari 99,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Apache Struts 1 ActionForm Denial-of-Service Vulnerability
Masuk KEV: 21 Januari 2022
Tenggat CISA: 21 Juli 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	struts	Semua versi sebelum 1.2.9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html broken link · exploit · patch · advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547 pemerintah AS
http://securitytracker.com/id?1015856 broken link · advisory pihak ketiga · vdb entry
http://www.securityfocus.com/bid/17342 broken link · advisory pihak ketiga · vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/25613 advisory pihak ketiga · vdb entry
http://issues.apache.org/bugzilla/show_bug.cgi?id=38534 issue tracking · permissions required
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html broken link
http://secunia.com/advisories/19493 broken link
http://secunia.com/advisories/20117 broken link
http://www.vupen.com/english/advisories/2006/1205 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.