Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

Remediation

References

CVE-2016-9013

Related Vulnerabilities

WordPress Plugin WPMktgEngine Security Bypass (3.7.6)

SugarCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-28955)

WordPress Plugin Easy Team Manager SQL Injection (1.3.2)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4300)

WebLogic Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-29577)

Severity

Critical

Classification

CVE-2016-9013 CWE-798 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities