Observable Timing Discrepancy
CVE-2025-13473
Summary
An issue was discovered in versions prior to 4.2.28, 5.x prior to 5.2.11, and 6.x prior to 6.0.2. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Django would like to thank Stackered for reporting this issue.
- HIGH
- NETWORK
- NONE
- UNCHANGED
- NONE
- LOW
- HIGH
- NONE
CWE-208 - Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Advisory Timeline
- Published
