CVE-2006-6697

CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.

Published: Dec 22, 2006
Updated: Apr 13, 2023
CVE: CVE-2006-6697
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
oracle / application_server_portal	10g	10g.x
oracle / application_server_portal	9.0.2	9.0.2.x

http://marc.info/?l=full-disclosure&m=116664018702238&w=2
http://marc.info/?l=full-disclosure&m=116666155824901&w=2
http://secunia.com/advisories/23461
http://securityreason.com/securityalert/2057
http://www.securityfocus.com/archive/1/454945/100/0/threaded
http://www.securityfocus.com/archive/1/454965/100/0/threaded
http://www.securityfocus.com/archive/1/455106/100/0/threaded
http://www.securityfocus.com/bid/21686
http://www.vupen.com/english/advisories/2006/5124

Vulnerability Database

289,784

CVE-2006-6697