FlawAtlas
Search the atlas
CVE-2016-2513 Low

CVE-2016-2513

The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

Exploit probability 3.3%
Published April 8, 2016
Required by Not available
Last source change June 10, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

4 explicit affected versions

PyPI django

104 explicit affected versions

PyPI django

102 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2016-2513

The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

View original source
Open Source Vulnerabilities PYSEC-2016-16

The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

View original source
Open Source Vulnerabilities GHSA-fp6p-5xvw-m74f

The password hasher in `contrib/auth/hashers.py` in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

View original source

05 / REFERENCES

Further evidence