{"id":"CVE-2016-9013","aliases":["ALPINE-CVE-2016-9013","DEBIAN-CVE-2016-9013","DSA-3835-1","EUVD-2016-0006","GHSA-mv8g-fhh6-6267","MGASA-2016-0368","PYSEC-2016-17","SUSE-SU-2018:0973-1","SUSE-SU-2018:1102-1","UBUNTU-CVE-2016-9013","USN-3115-1"],"status":"published","title":"Django user with hardcoded password created when running tests on Oracle","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.05144,"percentile":0.92453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-798"],"published":"2016-11-01T00:00:00Z","modified":"2026-10-24T10:30:40Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.10.3","1.9.11","1.8.16"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.2","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"py-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"py3-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-django","fixed_in":["1.8.16-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1:1.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1:1.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1:1.10.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10a1"},{"fixed":"1.10.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9a1"},{"fixed":"1.9.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8.16"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.2","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.11-1+deb8u2"}]}],"versions":["1.7.10-1","1.7.11-1","1.7.11-1+deb8u1","1.7.7-1","1.7.7-1+deb8u1","1.7.7-1+deb8u2","1.7.7-1+deb8u3","1.7.7-1+deb8u4","1.7.7-1+deb8u5","1.7.9-1"],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10a1"},{"fixed":"1.10.3"}]}],"versions":["1.10","1.10.1","1.10.2","1.10a1","1.10b1","1.10rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9a1"},{"fixed":"1.9.11"}]}],"versions":["1.9","1.9.1","1.9.10","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9a1","1.9b1","1.9rc1","1.9rc2"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8.16"}]}],"versions":["1.8","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8"},{"fixed":"1.8.16"},{"introduced":"1.9"},{"fixed":"1.9.11"},{"introduced":"1.10"},{"fixed":"1.10.3"}]}],"versions":["1.10","1.10.1","1.10.2","1.8","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.9","1.9.1","1.9.10","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.16"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.4"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.16"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.4"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"djangoproject","product":"django"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://www.djangoproject.com/weblog/2016/nov/01/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-3835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-3115-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/94069","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.securitytracker.com/id/1037159","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9013","tags":["advisory"]},{"url":"https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e","tags":["web"]},{"url":"https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b","tags":["web"]},{"url":"https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2016/nov/01/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-17.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mv8g-fhh6-6267","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9013","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9013","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0368.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19690","tags":["report"]},{"url":"https://www.ubuntu.com/usn/usn-3115-1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001374","tags":["report"]},{"url":"https://bugzilla.suse.com/1008047","tags":["report"]},{"url":"https://bugzilla.suse.com/1008050","tags":["report"]},{"url":"https://bugzilla.suse.com/1031450","tags":["report"]},{"url":"https://bugzilla.suse.com/1031451","tags":["report"]},{"url":"https://bugzilla.suse.com/1056284","tags":["report"]},{"url":"https://bugzilla.suse.com/1083304","tags":["report"]},{"url":"https://bugzilla.suse.com/1083305","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181102-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/967999","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2512","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9013","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3115-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9014","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-9013","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-12-09T20:00:00Z","modified":"2024-08-06T02:35:02.828Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-0006","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-12-09T20:00:00Z","modified":"2024-08-06T02:35:02Z","updated_at":"2026-11-03T02:22:29.188942Z"}],"ghsa":[{"id":"GHSA-mv8g-fhh6-6267","title":"Django user with hardcoded password created when running tests on Oracle","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2022-05-17T00:27:18Z","modified":"2024-09-18T15:59:34Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2016-9013","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-12-09T20:59:05.657Z","modified":"2026-06-17T00:55:17.687Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:03:32.79141Z"}],"osv":[{"id":"ALPINE-CVE-2016-9013","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-12-09T20:59:05.657Z","modified":"2026-09-22T06:30:43.800395636Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2016-9013","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-12-09T20:59:05.657Z","modified":"2026-10-24T10:30:40.850532176Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-9013","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-12-09T20:59:05.657Z","modified":"2026-09-22T07:03:09.265813207Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"GHSA-mv8g-fhh6-6267","title":"Django user with hardcoded password created when running tests on Oracle","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2022-05-17T00:27:18Z","modified":"2024-09-18T16:08:25.217294Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"UBUNTU-CVE-2016-9013","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-11-01T00:00:00Z","modified":"2026-02-04T02:47:35.356222Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DSA-3835-1","title":"python-django - security update","status":"published","published":"2017-04-26T00:00:00Z","modified":"2026-03-09T01:22:13.767677Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0368","title":"Updated python-django packages fix security vulnerabilities","description":"User with hardcoded password created when running tests on Oracle\nWhen running tests with an Oracle database, Django creates a temporary\ndatabase user. In older versions, if a password isn't manually specified\nin the database settings TEST dictionary, a hardcoded password is used.\nThis could allow an attacker with network access to the database server\nto connect. (CVE-2016-9013)\n\nDNS rebinding vulnerability when DEBUG=True\nOlder versions of Django don't validate the Host header against\nsettings.ALLOWED_HOSTS when settings.DEBUG=True. This makes them\nvulnerable to a DNS rebinding attack. (CVE-2016-9014)\n","status":"published","published":"2016-11-06T10:34:34Z","modified":"2026-04-16T06:24:35.101505211Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"PYSEC-2016-17","description":"Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.","status":"published","published":"2016-12-09T20:59:00Z","modified":"2026-06-10T17:01:00.937218824Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2018:0973-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)\n- CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)\n- CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)\n- CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)\n- CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)\n- CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)\n- CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)\n- CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)\n","status":"published","published":"2018-04-18T06:31:23Z","modified":"2026-02-04T03:21:17.825683Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1102-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)\n- CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)\n- CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)\n- CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)\n- CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)\n- CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)\n- CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)\n- CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)\n- CVE-2016-2512: Vulnerability in the function tils.http.is_safe_url could allow remote users to arbitrary \n                 web site and conduct phishing attacks. (bsc#bnc#967999)\n","status":"published","published":"2018-04-27T13:24:32Z","modified":"2026-02-04T03:51:17.509539Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3115-1","title":"python-django vulnerabilities","description":"Marti Raudsepp discovered that Django incorrectly used a hardcoded password\nwhen running tests on an Oracle database. A remote attacker could possibly\nconnect to the database while the tests are running and prevent the test\nuser with the hardcoded password from being removed. (CVE-2016-9013)\n\nAymeric Augustin discovered that Django incorrectly validated hosts when\nbeing run with the debug setting enabled. A remote attacker could possibly\nuse this issue to perform DNS rebinding attacks. (CVE-2016-9014)\n","status":"published","published":"2016-11-01T16:48:36Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}