CVE-2006-1548

mediumpriority · track · 19EPSS 0.055 · 93 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

5.45% (93rd) EPSS

CVSS 4.3 · medium

Is it mine?

5 products

Check your exposure

Who says so?

4 sources

enisa_euvd · nvd · osv · redhat_csaf

EPSS · scored 2026-10-27

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRed Hat Application Server 3ASredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
https://access.redhat.com/errata/RHSA-2006:0281
FixedRed Hat Application Server v2 4ASredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
https://access.redhat.com/errata/RHSA-2006:0281

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–4.3

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v2.03.7lowAV:N/AC:M/Au:N/C:N/I:P/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

affected products (5)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
apache struts≤ 1.2.8nvdUScpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
Maven struts:struts< 1.2.9osvUSpkg:maven/struts/struts
Red Hat Application Server 3ASall versionsfixedredhat_csafUScpe:/a:redhat:rhel_application_server:1
Red Hat Application Server v2 4ASall versionsfixedredhat_csafUScpe:/a:redhat:rhel_application_server:2

advisories (2)

Vendor and ecosystem advisories describing this.

RHSA-2006:0281Red Hat Security Advisory: struts security update for Red Hat Application Server2006-05-03csaf · redhat_csafUS
An updated Struts package that fixes several security issues is now available for Red Hat Application Server. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
GHSA-p3vw-fvwx-qcv5Cross-site scripting in Apache Struts2022-05-01ghsa · osvUS
Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd nvd osv redhat_csaf NVD CVE.org MITRE

published 2006-03-30modified 2026-06-16

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan