CRLF Injection Vulnerability in Oracle Portal Products
CVE-2006-6697

Currently unrated

Key Information:

Vendor: Oracle
Status: Application Server Portal
Vendor: CVE Published:; 22 December 2006

What is CVE-2006-6697?

A CRLF injection vulnerability exists within the calendar.jsp file of Oracle Portal 10g and prior versions, which allows remote attackers to inject arbitrary HTTP headers. This can result in HTTP response splitting attacks, potentially leading to security exploits such as session hijacking, cache poisoning, and cross-site scripting (XSS). Proper validation and sanitization of user inputs, particularly within the 'enc' parameter, are crucial for safeguarding against such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch