Use of Hard-coded Credentials in Django | CVE-2016-9013

Q: How to fix?

There is no fixed version for RHEL:10 Django .

Threat Intelligence

2.72% (86^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use of Hard-coded Credentials vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-RHEL10-DJANGO-9887415
published28 Apr 2025
disclosed1 Nov 2016

Report a new vulnerability Found a mistake?

Introduced: 1 Nov 2016

CVE-2016-9013 (opens in a new tab) CWE-798 (opens in a new tab)

How to fix?

There is no fixed version for RHEL:10 Django.

NVD Description

Note: Versions mentioned in the description apply only to the upstream Django package and not the Django package as distributed by RHEL. See How to fix? for RHEL:10 relevant fixed versions and status.

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

Use of Hard-coded Credentials Affecting Django package, versions *

Severity