CVE-2018-16984: Django - Password Hash Disclosure
Summary
CVE-2018-16984: An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. Affects django versions >= 2.1, < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It includes features such as an ORM (Object-Relational Mapping) for database management, a templating engine, and an authentication system. This vulnerability affects Django versions before 2.1.2 and specifically impacts the password hash obfuscation mechanism used in the Django Admin interface. The vulnerability allows unprivileged users with only the 'view' permission to read the password hashes of arbitrary accounts, potentially exposing sensitive information.
Vulnerability Detail
The issue arises from a bypass in the read-only password widget used by Django Admin. This widget is designed to display an obfuscated password hash, but it fails to properly enforce access restrictions for users with limited permissions. As a result, users with only the 'view' permission can see the complete password hash, which can be a security risk for sites that use insecure password hashing algorithms. This vulnerability poses a threat to sites with legacy user accounts that may have been stored using weak or outdated hashing methods.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.2
This is the first release that contains the fix.
pip install --upgrade "django==2.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Django to address the issue.
Conclusion
The vulnerability in Django versions before 2.1.2 allows unprivileged users to view complete password hashes, potentially compromising user accounts. It is crucial to upgrade to the fixed version of Django to address this issue and ensure the protection of sensitive user information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows unprivileged users to view the complete password hashes of user accounts, which can lead to unauthorized access if the hashes are cracked or if weak hashing algorithms were used.
Sites using Django versions before 2.1.2 are affected. Specifically, sites with legacy user accounts that may have been stored using insecure password hashing methods are at higher risk.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to address the issue promptly by upgrading to the fixed version of Django.
No, the vulnerability is not related to access control settings. It is a flaw in the read-only password widget used by Django Admin, which fails to properly enforce access restrictions based on user permissions.
You can use Vulert's vulnerability monitoring service to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities, including this Django vulnerability. Visit Vulert Scanner for more information.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
