CVE-2006-1546, CVE-2006-1547, CVE-2005-3745 - any impact?

[david-a-campbell-aus]

https://github.com/weblegacy/struts1 documents fixed vulnerabilities but these CVEs below aren't on the list and they flag up for me using Sonatype IQ Server scanning software, against Struts 1, probably because of the detail as described further below here.

CVE-2006-1546
CVE-2006-1547
CVE-2005-3745

Are the above known to have any impact on struts 1.x?

https://nvd.nist.gov/vuln/detail/CVE-2006-1546 says "Up to (including) 1.2.8"
https://nvd.nist.gov/vuln/detail/CVE-2006-1547 says "Up to (excluding) 1.2.9"
https://nvd.nist.gov/vuln/detail/cve-2005-3745 says "Apache Struts 1.2.7, and possibly other versions"

[ste-gr]

Hi David,

I documented "only" fixed vulnerabilities since version 1.3.10.

For your question I found following infos:

Fixed with 1.2.9:

• Release Notes - Version 1.2.9
• CVE-2006-1546
  • STR-2742 - Validation always skipped with Globals.CANCEL_KEY
• CVE-2006-1547
  • STR-2765 - DOS attack, application hack
• CVE-2006-1548
  • STR-2781 - XSS vulnerability in LookupDispatchAction
• see also
  • Red Hat Bugzilla – Bug 187542

Fixed with 1.2.8:

• Release Notes - Version 1.2.8
  • 2005-11-05 / SVN 331060 (SVN 331055) / Fix for Struts XSS Vulnerability - remove uri from error messages.
• CVE-2005-3745
  • SVN 331060 - apache/struts1@d75d351 and
  • SVN 331055 - apache/struts1@7f10cdd
  • see also
    • StrutsXssVulnerability
    • Red Hat Bugzilla – Bug 173929
    • Security Advisory: Struts Error Message Cross Site Scripting

I hope it helps.

Greetings
Stefan