CVE-2016-9013

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

References

https://www.djangoproject.com/weblog/2016/nov/01/security-releases/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/

http://www.ubuntu.com/usn/USN-3115-1

http://www.securitytracker.com/id/1037159

http://www.securityfocus.com/bid/94069

http://www.debian.org/security/2017/dsa-3835

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3