CVE-2006-6697

EPSS 34.32%
Veröffentlicht 22.12.2006 02:28:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 12

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Oracle ≫ Application Server Portal Version9.0.2

Oracle ≫ Application Server Portal Version10g

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	34.32%	0.968

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

http://marc.info/?l=full-disclosure&m=116664018702238&w=2

http://marc.info/?l=full-disclosure&m=116666155824901&w=2

http://secunia.com/advisories/23461

http://securityreason.com/securityalert/2057

http://www.securityfocus.com/archive/1/454945/100/0/threaded

http://www.securityfocus.com/archive/1/454965/100/0/threaded

http://www.securityfocus.com/archive/1/455106/100/0/threaded

http://www.securityfocus.com/bid/21686

http://www.vupen.com/english/advisories/2006/5124

https://nvd.nist.gov/vuln/detail/CVE-2006-6697

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2006-6697

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2006-6697

EUVD