CNNVD-202602-383 Information

CNNVD ID

CNNVD-202602-383

Related CVE

CVE-2025-13473

• CNNVD Published: 2026-02-03

Description (Chinese)

Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 6.0.2之前版本、5.2.11之前版本和4.2.28之前版本存在安全漏洞，该漏洞源于django.contrib.auth.handlers.modwsgi.check_password函数存在时序攻击，可能导致用户枚举。

Description (English)

Django is an open-source Web application framework based on the Python language of the Django Foundation. The framework includes object-oriented maprs, view systems, templates, etc. There is a security loophole in previous versions of Django 6.2, 5.2.11 and 4.2.28, which originates from the time-series attack of the django.contrib.auth.handlers.modwsgi.check password function, which may lead to a user count.

Hazard Level

High

Vulnerability Type

其他

Affected Vendor

Django

Published

2026-02-03

Last Modified

2026-02-24

References

https://docs.djangoproject.com/en/dev/releases/security/ https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/feb/03/security-releases/ https://access.redhat.com/security/cve/cve-2025-13473

Patch

https://docs.djangoproject.com/en/dev/releases/security/