CVE-2016-9013

Aliases:GHSA-mv8g-fhh6-6267PYSEC-2016-17
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 09 Dec 2016, 20:00
Last modified:06 Aug 2024, 02:35

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.0 (nvd)
EPSS Score
1.23% LOW
1% probability -0.62%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Dec 2016, 20:00
Published
Vulnerability first disclosed
06 Aug 2024, 02:35
Last Modified
Vulnerability information updated

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 1.23%• Percentile: 79%

Techniques & Countermeasures

  • CWE-798•Use of Hard-coded Credentials

    The product contains hard-coded credentials, such as a password or cryptographic key.

Affected Systems

  • canonical•ubuntu_linux

    12.04 | 14.04 | 16.04 | 16.10

  • djangoproject•django

    1.10 | 1.10.1 | 1.10.2 | 1.9 | 1.9.1 | 1.9.2 | 1.9.3 | 1.9.4 | 1.9.5 | 1.9.6 | 1.9.7 | 1.9.8 | 1.9.9 | 1.9.10 | 1.8 | 1.8.1 | 1.8.2 | 1.8.3 | 1.8.4 | 1.8.5 | 1.8.6 | 1.8.7 | 1.8.8 | 1.8.9 | 1.8.10 | 1.8.11 | 1.8.12 | 1.8.13 | 1.8.14 | 1.8.15

  • fedoraproject•fedora

    24 | 25

  • PyPI•django

    ≥ 1.10a1, < 1.10.3 | ≥ 1.9a1, < 1.9.11 | ≥ 1.8a1, < 1.8.16 | ≥ 1.10, < 1.10.3

References (18)