CVE-2016-9013

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-12-09 · updated 2026-06-17
Weakness: CWE-798

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 16.10
Django: 1.10, 1.10.1, 1.10.2, 1.9, 1.9.1, 1.9.2 (+24)
Fedoraproject Fedora: 24, 25

References

http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94069
http://www.securitytracker.com/id/1037159
http://www.ubuntu.com/usn/USN-3115-1
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94069
http://www.securitytracker.com/id/1037159
http://www.ubuntu.com/usn/USN-3115-1
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/

Get alerted when CVE-2016-9013 or the next vulnerability affects your stack