CVE-2006-6697: Oracle Application Server Portal

High severity, CVSS 7.5. EPSS: 13.1% chance of exploitation in the next 30 days.

CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.

Affected products

• Oracle Application Server Portal: version 9.0.2 only; version 10g only

Published 2006-12-22. Last modified 2026-06-16.