Django has Observable Timing Discrepancy

TRUNG BÌNH 5.3CVE-2025-13473 · BIT-django-2025-13473 · GHSA-2mcm-79hx-8fxw · Công bố 03/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-13473 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng django, django (djangoproject).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.80%, cao hơn 56.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.2.28, 5.2.11, 6.0.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
django PyPI	`≥ 4.2, < 4.2.28≥ 4.2a1, < 4.2.28≥ 5.2, < 5.2.11≥ 5.2a1, < 5.2.11≥ 6.0, < 6.0.2≥ 6.0a1, < 6.0.2`	`4.2.285.2.116.0.2`
django djangoproject	`≥ 4.2, < 4.2.28≥ 5.2, < 5.2.11≥ 6.0, < 6.0.2`	`4.2.285.2.116.0.2`

Mô tả

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

The django.contrib.auth.handlers.modwsgi.check_password() function for authentication via mod_wsgi allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Stackered for reporting this issue.

Mô tả của NVD

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.