Apache Struts 1 ActionForm Denial-of-Service Vulnerability (CVE-2006-1547)
Severity: high · Patch status: patched · Since 2022-01-21 · CVE-2006-1547
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). CISA added CVE-2006-1547 to its Known Exploited Vulnerabilities catalog on Jan 21, 2022, which means attackers are exploiting it in the wild.
What to do
- Apply updates per vendor instructions.
- US federal agencies must remediate by Jul 21, 2022 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
