CVE-2016-2513: djangoproject django
Vulnerability summary
CVE-2016-2513 is a low (CVSS 3.1) vulnerability in djangoproject django. EPSS estimates a 3.35% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities.
Not severe (CVSS 3.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 2Timeline
- 08-04-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated3.1LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
3.35%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.35% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- python-django< 1.9.4-1
Djangoproject1 product
- djangoEOL1.8.9 | 1.9 | 1.9.1 | 1.9.2
PyPI1 product
- django< 1.8.10 | < 67b46ba7016da2d259c1ecc7d666d11f5e1cfaab | ≥ 1.9, < 1.9.3
Ubuntu1 product
- python-django< 1.6.1-2ubuntu0.12
4 vendors · 4 products
References
26 linksShow all 26 references
- www.djangoproject.com/weblog/2016/mar/01/security-releases/X Refsource CONFIRMVendor AdvisoryARTICLEREPORT
- github.com/django/djangoPACKAGE
