DEBIAN-CVE-2016-9013

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2016-9013
Downstream
DSA-3835-1
Published: 09 Dec 2016, 20:59
Last modified:28 Apr 2026, 20:16

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
3.0 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Dec 2016, 20:59
Published
Vulnerability first disclosed
28 Apr 2026, 20:16
Last Modified
Vulnerability information updated

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

CVSS Metrics

  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Systems

  • debian•python-django

    < 1:1.10.3-1 | < 1:1.10.3-1 | < 1:1.10.3-1 | < 1:1.10.3-1

References (1)