CVE-2025-13473
BaseFortify
Publication date: 2026-02-03
Last updated on: 2026-02-04
Assigner: Django Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| djangoproject | django | From 4.2 (inc) to 4.2.28 (exc) |
| djangoproject | django | From 5.2 (inc) to 5.2.11 (exc) |
| djangoproject | django | From 6.0 (inc) to 6.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-208 | Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to enumerate valid usernames via a timing attack in the authentication process. This could potentially aid attackers in further attacks such as brute force or credential stuffing.
Such unauthorized user enumeration and potential subsequent attacks may lead to unauthorized access or data breaches, which can impact compliance with standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information.
Therefore, failure to patch this vulnerability could increase the risk of non-compliance with these regulations due to compromised user data confidentiality and integrity.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2025-13473 is a security vulnerability in Django's mod_wsgi authentication handler that allows remote attackers to enumerate valid usernames by exploiting timing differences during the authentication process."}, {'type': 'paragraph', 'content': 'Specifically, the function django.contrib.auth.handlers.modwsgi.check_password() leaks information through the time it takes to respond to authentication attempts, enabling an attacker to determine which usernames exist on the system.'}, {'type': 'paragraph', 'content': 'This vulnerability affects Django versions 4.2, 5.2, and 6.0 before certain patched releases.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to discover valid usernames on your Django application remotely.
Knowing valid usernames can facilitate further attacks such as brute force password attempts or credential stuffing, increasing the risk of unauthorized access.
Although the vulnerability is considered low severity, it still weakens the security posture of your authentication system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves username enumeration via timing differences in the mod_wsgi authentication handler. Detection would involve observing timing discrepancies in authentication responses that could indicate a timing attack.
However, no specific commands or detection methods are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are strongly encouraged to upgrade Django to the patched versions: 6.0.2, 5.2.11, or 4.2.28, depending on their current version.
Applying these security releases will address the timing attack issue in the mod_wsgi authentication handler and prevent username enumeration.