CVE-2016-9013

Critical

Published: 09/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Django versions 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user, making it easier for remote attackers to gain access to the database server.

Risk Assessment

Failure to manually specify a password in the TEST database settings may lead to unauthorized access to the database, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update Django to the latest version and manually configure the password for the database user in the TEST settings.

Original NVD description (English source)

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.