CVE-2016-2513 — Sensitive Information Exposure in Django

CWE-200 — Sensitive Information ExposureCWE-385 — Covert Timing Channel15 documents8 sources
Severity
3.1LOWNVD
OSV7.4
EPSS
1.3%
top 20.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Djangoproject Django
Timeline
PublishedApr 8
Latest updateMay 17

Description

The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 1.6 | Impact: 1.4

Affected Packages2 packages

▶PyPIdjangoproject/django1.9 — 1.9.3+1
▶NVDdjangoproject/django4 versions+3

🔴Vulnerability Details

6
OSV
Django User Enumeration Vulnerability↗2022-05-17
▶
GHSA
Django User Enumeration Vulnerability↗2022-05-17
▶
OSV
CVE-2016-2513: The password hasher in contrib/auth/hashers↗2016-04-08
▶
CVEList
CVE-2016-2513: The password hasher in contrib/auth/hashers↗2016-04-08
▶
OSV
python-django regression↗2016-03-07
▶

📋Vendor Advisories

3
Ubuntu
Django vulnerabilities↗2016-03-01
▶
Red Hat
python-django: User enumeration through timing difference on password hasher work factor upgrade↗2016-03-01
▶
Debian
CVE-2016-2513: python-django - The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x...↗2016
▶

💬Community

5
Bugzilla
CVE-2016-2513 python-django15: python-django: User enumeration through timing difference on password hasher work factor upgrade [epel-6]↗2016-03-04
▶
Bugzilla
CVE-2016-2513 python-django: User enumeration through timing difference on password hasher work factor upgrade [fedora-all]↗2016-03-04
▶
Bugzilla
CVE-2016-2513 python-django: User enumeration through timing difference on password hasher work factor upgrade [epel-7]↗2016-03-04
▶
Bugzilla
CVE-2016-2513 django14: python-django: User enumeration through timing difference on password hasher work factor upgrade [epel-6]↗2016-03-04
▶
Bugzilla
CVE-2016-2513 python-django: User enumeration through timing difference on password hasher work factor upgrade↗2016-02-24
▶
CVE-2016-2513 — Sensitive Information Exposure | cvebase