CVE

Id
17650  
CVE No.
CVE-2006-1546  
Status
Candidate  
Description
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a "org.apache.struts.taglib.html.Constants.CANCEL" parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.  
Phase
Assigned (20060330)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
147626 17650 CVE-2006-1546 MLIST:[struts-user] 20060121 Validation Security Hole?  View
147627 17650 CVE-2006-1546 URL:http://mail-archives.apache.org/mod_mbox/struts-user/200601.mbox/%3c20060121221800.15814.qmail@web32607.mail.mud.yahoo.com%3e  View
147628 17650 CVE-2006-1546 MLIST:[struts-devel] 20060122 Re: Validation Security Hole?  View
147629 17650 CVE-2006-1546 URL:http://mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%3cdr169r$623$2@sea.gmane.org%3e  View
147630 17650 CVE-2006-1546 CONFIRM:http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html  View
147631 17650 CVE-2006-1546 CONFIRM:http://issues.apache.org/bugzilla/show_bug.cgi?id=38374  View
147632 17650 CVE-2006-1546 SUSE:SUSE-SR:2006:010  View
147633 17650 CVE-2006-1546 URL:http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html  View
147634 17650 CVE-2006-1546 BID:17342  View
147635 17650 CVE-2006-1546 URL:http://www.securityfocus.com/bid/17342  View
147636 17650 CVE-2006-1546 VUPEN:ADV-2006-1205  View
147637 17650 CVE-2006-1546 URL:http://www.vupen.com/english/advisories/2006/1205  View
147638 17650 CVE-2006-1546 SECTRACK:1015856  View
147639 17650 CVE-2006-1546 URL:http://securitytracker.com/id?1015856  View
147640 17650 CVE-2006-1546 SECUNIA:19493  View
147641 17650 CVE-2006-1546 URL:http://secunia.com/advisories/19493  View
147642 17650 CVE-2006-1546 SECUNIA:20117  View
147643 17650 CVE-2006-1546 URL:http://secunia.com/advisories/20117  View
147644 17650 CVE-2006-1546 XF:struts-iscancelled-security-bypass(25612)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
58734 JVNDB-2006-001000 Apache Struts の LookupDispatchAction、DispatchAction および ActionDispatcher におけるクロスサイトスクリプティングの脆弱性 Apache Struts の LookupDispatchAction、DispatchAction および ActionDispatcher には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2006-1548 17650 4.3 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-001000.html  View