CVE-2016-2513

Published: Apr 8, 2016Modified: May 6, 2026

3.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: NVD

Description

The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

Affected (4)

Products: Djangoproject: Django

Djangoproject

1 product

Django

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.8.9
Djangoproject Django	Version 1.9.1
Djangoproject Django	Version 1.9.2
Djangoproject Django	Version 1.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (26)

http://rhn.redhat.com/errata/RHSA-2016-0502.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-0504.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-0505.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-0506.html

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3544

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/83878

Source: cve@mitre.org

http://www.securitytracker.com/id/1035152

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2915-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2915-2

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2915-3

Source: cve@mitre.org

https://github.com/django/django/commit/67b46ba7016da2d259c1ecc7d666d11f5e1cfaab

Source: cve@mitre.org

https://www.djangoproject.com/weblog/2016/mar/01/security-releases/

Source: cve@mitre.org

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2016-0502.html