Context Navigation

Changes between Version 3 and Version 4 of Ticket #34661

-              v3
+              v4
 There is one more element needed for hashing the password, **pepper**, should be django project specific. Even when a database is exposed, the attacker will not be able to lookup the known passwords, since they don't have the secret pepper key.
 I am not sure, however this cause CWE-760 https://cwe.mitre.org/data/definitions/760.html, even though salt is not weak, but it is known, when a database is exposed.
+I am not sure about the vulnerability enumeration, however this cause CWE-760 [0] even though salt is not weak, but it is known, when a database is exposed. Because the salt is stored next to the hashed password.
 I think peppering passwords should be a default behavior of django.
+[0] [https://cwe.mitre.org/data/definitions/760.html,]