VDB
ALPINE-CVE-2016-9013
ALPINE-CVE-2016-9013
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.8 | py-django | 1.8.8-r0, 1.8.6-r0, 1.8.4-r0 |
| Alpine:v3.5 | py-django | 1.8.8-r0, 1.2.5-r0, 1.2.5-r1 |
| Alpine:v3.4 | py-django | 0, 1.8.8-r0, 1.8.7-r0 |
| Alpine:v3.3 | py-django | 1.2.5-r0, 1.8.7-r0, 1.8.6-r0 |
| Alpine:v3.9 | py-django | 1.4.1-r0, 1.5-r0, 1.5.1-r0 |
| Alpine:v3.10 | py-django | 1.8-r0, 0, 1.2.5-r1 |
| Alpine:v3.2 | py-django | 1.8.3-r1, 1.8.3-r0, 1.8.15-r0 |
| Alpine:v3.7 | py-django | 1.2.5-r0, 1.2.5-r1, 1.5.7-r0 |
| Alpine:v3.6 | py-django | 0, 1.2.5-r0, 1.2.5-r1 |
| Alpine:v3.12 | py3-django | 1.2.5-r0, 0, 1.8.8-r0 |
| Alpine:v3.11 | py3-django | 1.8.8-r0, 1.2.5-r0, 0 |
Timeline
- Dec 9, 2016 CVE Published
- Nov 19, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch