CVE-2006-6697

CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

10.64% chance of exploitation in the next 30 days, 95th percentile

Published

2006-12-22

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/29301

References

• CVE Record
• NVD entry

Related

• CVE-2006-6696
• CVE-2006-6703
• CVE-2006-6694
• CVE-2006-6707
• CVE-2006-6692
• CVE-2006-6708