{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-11-01T00:00:00", "descriptions": [{"lang": "en", "value": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-11-03T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/"}, {"name": "FEDORA-2016-d4571bf555", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/"}, {"name": "DSA-3835", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2017/dsa-3835"}, {"name": "USN-3115-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-3115-1"}, {"name": "94069", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94069"}, {"name": "1037159", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1037159"}, {"name": "FEDORA-2016-3eb5a55123", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-9013", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/", "refsource": "CONFIRM", "url": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/"}, {"name": "FEDORA-2016-d4571bf555", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/"}, {"name": "DSA-3835", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3835"}, {"name": "USN-3115-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-3115-1"}, {"name": "94069", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94069"}, {"name": "1037159", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1037159"}, {"name": "FEDORA-2016-3eb5a55123", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T02:35:02.828Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/"}, {"name": "FEDORA-2016-d4571bf555", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/"}, {"name": "DSA-3835", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2017/dsa-3835"}, {"name": "USN-3115-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-3115-1"}, {"name": "94069", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/94069"}, {"name": "1037159", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1037159"}, {"name": "FEDORA-2016-3eb5a55123", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-9013", "datePublished": "2016-12-09T20:00:00", "dateReserved": "2016-10-25T00:00:00", "dateUpdated": "2024-08-06T02:35:02.828Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:1.10:*:*:*:*:*:*:*", "matchCriteriaId": "FE21DA5F-C086-4E98-A5DD-2B96731B56D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "2CE31960-7C68-42F3-B215-B30A87DB67CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "B3838B8E-8F0E-4F7A-88E6-FFF2590E5302", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*", "matchCriteriaId": "1AFB20FA-CB00-4729-AB3A-816454C6D096", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*", "matchCriteriaId": "29C40BAC-6DF3-4EA2-A65A-86462DDD8723", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "6B754401-8503-4553-853F-4F6BCD2D2FF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*", "matchCriteriaId": "019C26C7-EF1F-45BB-934E-521E2E64452E", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "A18691A7-E4D0-48A4-81A7-89846E991AF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*", "matchCriteriaId": "7C06EBD9-381E-4018-BFDC-E23EA18097B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*", "matchCriteriaId": "7D134048-B64F-45AE-B4A2-26E516CCF37B", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "0F39B83A-C10B-4B88-9491-2FB8B07D6EA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*", "matchCriteriaId": "64A4030E-F51F-4944-BCE7-E27CD32EC7D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*", "matchCriteriaId": "CCC1F046-DAF7-4734-9F80-A3C57857AF18", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*", "matchCriteriaId": "61EE8536-0E8D-477A-B8EA-817CE21D516A", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*", "matchCriteriaId": "483D0F44-15C8-43A2-B3AE-331F40DA1A80", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:1.8:*:*:*:*:*:*:*", "matchCriteriaId": "6BCCB794-1F30-4FC2-A63A-BCE7539BE5DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "2510BAD7-1FB6-4F6F-A2CC-9DE9AD39B4FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "D1B388C7-ED4E-4416-969F-32263E7D7AA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "63D36984-4C8E-4CDB-8D15-445705FCECF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "3B324AE6-ADD8-41B9-B250-A6577ACBB364", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*", "matchCriteriaId": "F6487058-6768-4AD3-BE27-A0B3D1ACFC08", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*", "matchCriteriaId": "0CFF0538-B111-44A8-ADC2-87E280186257", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*", "matchCriteriaId": "C3343FF8-53EC-459D-B31C-CD363D04FF42", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*", "matchCriteriaId": "B9B637E9-067A-4473-9B50-433CCC177982", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*", "matchCriteriaId": "99A5BF6D-631B-4C8E-9868-579BD79100C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*", "matchCriteriaId": "280B9958-9163-4126-910A-2EF4B408DFCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*", "matchCriteriaId": "6A40373B-301E-4B81-8FA5-28D916142F59", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*", "matchCriteriaId": "79BB3174-7859-4195-B7B3-BCAA280A6F80", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*", "matchCriteriaId": "42EF41AF-B2FA-468A-B161-D9FE29CE53EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*", "matchCriteriaId": "48DF0100-F98E-4997-A8F7-DC07FA4A06D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*", "matchCriteriaId": "ECDC5647-8EA7-4595-88C2-541BC489ED2D", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*", "matchCriteriaId": "C729D5D1-ED95-443A-9F53-5D7C2FD9B80C", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*", "matchCriteriaId": "772E9557-A371-4664-AE2D-4135AAEB89AA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary."}, {"lang": "es", "value": "Django 1.8.x en versiones anteriores a 1.8.16, 1.9.x en versiones anteriores a 1.9.11 y 1.10.x en versiones anteriores a 1.10.3 utiliza una contrase\u00f1a embebida para un usuario de base de datos temporal creada al ejecutar pruebas con una base de datos Oracle, lo que hace m\u00e1s f\u00e1cil a atacantes remotos obtener acceso al servidor de la base de datos aprovechando el fallo para especificar manualmente una contrase\u00f1a en la configuraci\u00f3n del diccionario TEST de la base de datos."}], "id": "CVE-2016-9013", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-12-09T20:59:05.657", "references": [{"source": "cve@mitre.org", "url": "http://www.debian.org/security/2017/dsa-3835"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94069"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1037159"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.ubuntu.com/usn/USN-3115-1"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3835"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94069"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1037159"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.ubuntu.com/usn/USN-3115-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the Django project for reporting this issue.", "bugzilla": {"description": "python-django: user with hardcoded password created when running tests on Oracle", "id": "1389414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1389414"}, "csaw": false, "cvss": {"cvss_base_score": "4.0", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "status": "draft"}, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-798", "details": ["Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary."], "name": "CVE-2016-9013", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:1.3", "fix_state": "Not affected", "package_name": "Django", "product_name": "Red Hat Ceph Storage 1.3"}, {"cpe": "cpe:/a:redhat:ceph_storage:2", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Ceph Storage 2"}, {"cpe": "cpe:/a:redhat:openstack:5::el6", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)"}, {"cpe": "cpe:/a:redhat:openstack:6", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Enterprise Linux OpenStack Platform 6 (Juno)"}, {"cpe": "cpe:/a:redhat:openstack:7", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)"}, {"cpe": "cpe:/a:redhat:openstack-optools:7", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack:10", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 10 (Newton)"}, {"cpe": "cpe:/a:redhat:openstack-optools:10", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 10 (Newton) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack:8", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 8 (Liberty)"}, {"cpe": "cpe:/a:redhat:openstack-optools:8", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 8 (Liberty) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack:9", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 9 (Mitaka)"}, {"cpe": "cpe:/a:redhat:openstack-optools:9", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 9 (Mitaka) Operational Tools"}, {"cpe": "cpe:/a:redhat:rhscon:2", "fix_state": "Not affected", "package_name": "Django", "product_name": "Red Hat Storage Console 2"}, {"cpe": "cpe:/a:redhat:rhscon:2", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Storage Console 2"}, {"cpe": "cpe:/a:rhel_sam:1", "fix_state": "Will not fix", "package_name": "Django", "product_name": "Red Hat Subscription Asset Manager"}], "public_date": "2016-11-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-9013\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-9013"], "threat_severity": "Moderate"}