VULNERABILITY INTELLIGENCE
CVE-2016-9013
CVSS score9.8 CRITICAL
EPSS probability5.19%
CISA KEVNot currently listed
Published2016-12-09
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Weakness classification
- CWE-798: Use of Hard-coded Credentials
Primary references
- cve@mitre.org
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Release Notes, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108