ALPINE-CVE-2016-9013

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2016-9013
Published: 09 Dec 2016, 20:59
Last modified:19 Nov 2025, 06:06

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
3.0 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Dec 2016, 20:59
Published
Vulnerability first disclosed
19 Nov 2025, 06:06
Last Modified
Vulnerability information updated

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

CVSS Metrics

  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Systems

  • alpine•py-django

    < 1.8.16-r0 | < 1.8.16-r0 | < 1.8.16-r0 | < 1.8.16-r0 | < 1.8.16-r0 | < 1.8.16-r0 | < 1.8.16-r0 | < 1.8.16-r0 | < 1.8.16-r0

  • alpine•py3-django

    < 1.8.16-r0 | < 1.8.16-r0

References (1)