CVE-2025-13473
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-13473
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2025-13473.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 3:3.2.25-0+deb12u2 |
| debian | bullseye | fixed | 2:2.2.28-1~deb11u12 |
| debian | forky | fixed | 3:4.2.28-1 |
| debian | sid | fixed | 3:4.2.28-1 |
| debian | trixie | fixed | 3:4.2.28-0+deb13u1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-13473
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases
- https://docs.djangoproject.com/en/dev/releases/security/
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
- https://www.suse.com/security/cve/CVE-2025-13473.html
- https://security-tracker.debian.org/tracker/CVE-2025-13473
Verify integrity in audit chain (admin only). AS-IS.