CVE-2016-9013: Critical severity django vulnerability
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9013?
CVE-2016-9013 is considered a moderate severity vulnerability due to the potential for unauthorized database access.
How do I fix CVE-2016-9013?
To fix CVE-2016-9013, upgrade Django to version 1.8.16, 1.9.11, or 1.10.3 or later.
What versions of Django are affected by CVE-2016-9013?
Django versions 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 are affected by CVE-2016-9013.
What type of attack can exploit CVE-2016-9013?
CVE-2016-9013 can be exploited by remote attackers to gain unauthorized access to the Oracle database.
Is CVE-2016-9013 specific to any database type?
Yes, CVE-2016-9013 specifically involves a vulnerability in Django when used with an Oracle database.