Use of hardcoded DB password Affecting django package, versions [,1.8.16)[1.9,1.9.11)[1.10,1.10.3)


Severity

Recommended
0.0
critical
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
2.72% (86th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use of hardcoded DB password vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PYTHON-DJANGO-40439
  • published1 Nov 2016
  • disclosed1 Nov 2016
  • creditMarti Raudsepp

Introduced: 1 Nov 2016

CVE-2016-9013  (opens in a new tab)
CWE-259  (opens in a new tab)

Overview

django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package used a hardcoded password for a temporary database user created when running tests with an Oracle database. This user is usually dropped after the test suite completes, but not when using the manage.py test --keepdb option or if the user has an active session. This makes it easier for remote attackers to obtain access to the database.

CVSS Base Scores

version 3.1