Django user with hardcoded password created when running tests on Oracle
Critical severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated May 7, 2024
Package
Affected versions
>= 1.10, < 1.10.3
>= 1.9, < 1.9.11
>= 1.8, < 1.8.16
Patched versions
1.10.3
1.9.11
1.8.16
Description
Published by the National Vulnerability Database
Dec 9, 2016
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Apr 22, 2024
Last updated
May 7, 2024
Credits
-
MarkLee131 Analyst
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
References