How severe is CVE-2006-1547?

CVE-2006-1547 has a CVSS 3.1 base score of 7.5 (HIGH). EPSS estimates a 54.6% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2006-1547: Apache Struts 1 ActionForm Denial-of-Service

CISA Known Exploited Vulnerabilities

Apache Struts 1 ActionForm Denial-of-Service Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-01-21

Remediation due

2022-07-21

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2006-1547

Description

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Severity

CVSS 3.1 · CISA7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impactpartial

Exploitation Context

as of October 15, 2026

All KEV statistics→

CISA added CVE-2006-1547 to the KEV catalog 5,776 days after its CVE record was published.
It is one of 41 Apache entries in the CISA KEV catalog, and one of 13 added in 2022.
Its current EPSS score (54.6%) is higher than that of 52% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
-	-	n/a

References

9 Links

Vendor advisories

SUSE-SR:2006:010

Third-party advisories

Vulnerability databases

Other references

Record Details

Published

2006-03-30

Last updated

2025-10-22

Assigner (CNA)

redhat

Credited to

More from Apache

All Apache CVEs→

CVE-2017-97919.8 CRITICAL

Apache Struts 1 Improper Input Validation Vulnerability

Apache Software FoundationKEVEPSS 98.9%2017-07-10

CVE-2021-4422810 CRITICAL

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Software FoundationKEVEPSS 100.0%2021-12-10

CVE-2017-56389.8 CRITICAL

Apache Struts Remote Code Execution Vulnerability

Apache Software FoundationKEVEPSS 100.0%2017-03-11

CVE-2021-404389 CRITICAL

mod_proxy SSRF

Apache Software FoundationKEVEPSS 100.0%2021-09-16

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.