HIGH7.5

GHSA-7qwv-cwgj-c8rj

Improper Input Validation in Apache Struts

Quick fix

GHSA-7qwv-cwgj-c8rj — struts:struts: upgrade to the fixed version with the command below.

# pom.xml: bump <version>1.2.9</version> for struts:struts

Details

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/struts:struts

Introduced in: 0Fixed in: 1.2.9

Fix# pom.xml: bump <version>1.2.9</version> for struts:struts

References

https://nvd.nist.gov/vuln/detail/CVE-2006-1547[ADVISORY]
https://exchange.xforce.ibmcloud.com/vulnerabilities/25613[WEB]
https://github.com/apache/struts[PACKAGE]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547[WEB]
http://issues.apache.org/bugzilla/show_bug.cgi?id=38534[WEB]
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html[WEB]
http://secunia.com/advisories/19493[WEB]
http://secunia.com/advisories/20117[WEB]
http://securitytracker.com/id?1015856[WEB]
http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html[WEB]