CVE-2016-9013
Estado: ModificadaCrítica (9.8)—
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 5.19%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-798
Referencias
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94069
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94069
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-9013",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-12-09T20:59:05.657",
"references": [
{
"url": "http://www.debian.org/security/2017/dsa-3835",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/94069",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id/1037159",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.ubuntu.com/usn/USN-3115-1",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/",
"source": "cve@mitre.org"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/",
"source": "cve@mitre.org"
},
{
"url": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2017/dsa-3835",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/94069",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1037159",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ubuntu.com/usn/USN-3115-1",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.djangoproject.com/weblog/2016/nov/01/security-releases/",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-798"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary."
},
{
"lang": "es",
"value": "Django 1.8.x en versiones anteriores a 1.8.16, 1.9.x en versiones anteriores a 1.9.11 y 1.10.x en versiones anteriores a 1.10.3 utiliza una contraseña embebida para un usuario de base de datos temporal creada al ejecutar pruebas con una base de datos Oracle, lo que hace más fácil a atacantes remotos obtener acceso al servidor de la base de datos aprovechando el fallo para especificar manualmente una contraseña en la configuración del diccionario TEST de la base de datos."
}
],
"lastModified": "2026-06-17T00:55:17.687",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE21DA5F-C086-4E98-A5DD-2B96731B56D1"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CE31960-7C68-42F3-B215-B30A87DB67CC"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3838B8E-8F0E-4F7A-88E6-FFF2590E5302"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AFB20FA-CB00-4729-AB3A-816454C6D096"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29C40BAC-6DF3-4EA2-A65A-86462DDD8723"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B754401-8503-4553-853F-4F6BCD2D2FF2"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "019C26C7-EF1F-45BB-934E-521E2E64452E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A18691A7-E4D0-48A4-81A7-89846E991AF2"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C06EBD9-381E-4018-BFDC-E23EA18097B0"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D134048-B64F-45AE-B4A2-26E516CCF37B"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F39B83A-C10B-4B88-9491-2FB8B07D6EA5"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64A4030E-F51F-4944-BCE7-E27CD32EC7D4"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCC1F046-DAF7-4734-9F80-A3C57857AF18"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61EE8536-0E8D-477A-B8EA-817CE21D516A"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "483D0F44-15C8-43A2-B3AE-331F40DA1A80"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BCCB794-1F30-4FC2-A63A-BCE7539BE5DF"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2510BAD7-1FB6-4F6F-A2CC-9DE9AD39B4FF"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1B388C7-ED4E-4416-969F-32263E7D7AA8"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "63D36984-4C8E-4CDB-8D15-445705FCECF9"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B324AE6-ADD8-41B9-B250-A6577ACBB364"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6487058-6768-4AD3-BE27-A0B3D1ACFC08"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CFF0538-B111-44A8-ADC2-87E280186257"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3343FF8-53EC-459D-B31C-CD363D04FF42"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9B637E9-067A-4473-9B50-433CCC177982"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99A5BF6D-631B-4C8E-9868-579BD79100C7"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "280B9958-9163-4126-910A-2EF4B408DFCF"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A40373B-301E-4B81-8FA5-28D916142F59"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79BB3174-7859-4195-B7B3-BCAA280A6F80"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42EF41AF-B2FA-468A-B161-D9FE29CE53EB"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "48DF0100-F98E-4997-A8F7-DC07FA4A06D6"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ECDC5647-8EA7-4595-88C2-541BC489ED2D"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C729D5D1-ED95-443A-9F53-5D7C2FD9B80C"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "772E9557-A371-4664-AE2D-4135AAEB89AA"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}