PT-2006-2547 · Apache · Apache Struts

Paul Benedict

·

Published

2006-03-30

·

Updated

2023-02-13

·

CVE-2006-1546

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Apache Software Foundation (ASF) Struts versions prior to 1.2.9
Description: The issue allows remote attackers to bypass validation by sending a request with a parameter org.apache.struts.taglib.html.Constants.CANCEL, causing the action to be canceled without being detected by applications that do not use the isCancelled check.
Recommendations: For versions prior to 1.2.9, update to version 1.2.9 or later to resolve the issue. As a temporary workaround, consider adding the isCancelled check in applications to detect canceled actions.

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-1546
GHSA-VF8G-MPMW-QV87

Affected Products

Apache Struts