Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-22347 is a medium-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Hcltech Devops Velocity. Its CVSS base score is 5.9 (Medium).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-22347 is a cryptographic weakness (CWE-327) in IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity versions 4.0.0 through 4.0.25, where weaker than expected cryptographic algorithms are used. This flaw could enable an attacker to decrypt highly sensitive information. The vulnerability carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact but no integrity or availability effects.
A remote attacker with network access could potentially exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation would allow decryption of highly sensitive data stored or transmitted by the affected software, compromising confidentiality.
IBM has published a security bulletin at https://www.ibm.com/support/pages/node/7172750 providing details on the issue and recommended mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19908
Vulnerability Data
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-13 requires selection and implementation of specific cryptography types, directly stopping use of broken algorithms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.31 only requires identifying, reviewing and considering legal/regulatory/contractual requirements (including crypto restrictions); it does not itself stop use of a broken algorithm or block its exploitation
A.5.6 only promotes membership in groups to receive early warnings, advisories, and specialist advice about vulnerabilities (including risky crypto); it does not stop exploitation of an already-present broken algorithm, which requires other controls (e.g. A.8.24) to act.
A.8.24's policy, algorithm selection, strength/quality rules, approved standards and key management directly stop use of broken/risky algorithms in most cases; the bounded remainder is non-compliant implementations or legacy systems grandfathered under the clause's own regulatory and transition guidance.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.