CVE-2016-2513 - CVE House
Back to Database
Status published Low CVE-2016-2513

The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and...

Vulnerability Description

The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-2513

Credits & Attribution

No credits recorded in the NVD database.

References

More from djangoproject

View All →
CVE-2025-64460
Potential denial-of-service vulnerability in XML serializer text extraction
Unknown 0
CVE-2025-64459
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
Unknown 0
CVE-2025-64458
Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
Unknown 0
CVE-2025-59682
An issue was discovered in Django 4.2 before 4.2.25, 5.1...
Low 3.1
CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1...
High 7.1

Affected Vendor

djangoproject

View all reports →

Affected Software

django
Vulnerable Versions:
1.8.9, 1.9, 1.9.1, 1.9.2

Timeline

Official Publish: April 8th, 2016
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.