CVEvulnerability

CVE-2006-6697

7.5 HIGH Published 2006-12-22 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-12-22
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.

Affected configurations

• oracle application server portal 9.0.2 • oracle application server portal 10g

References