Security Resilience

CVE-2024-22892

Crypto Weakness in Openslides 4.0.15

Crypto Weakness
Published
25 September 2024
Modified
14 March 2025
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0025 15th percentile
Risk Priority 56 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-22892 is a high-severity Inadequate Encryption Strength (CWE-326) vulnerability in Openslides Openslides. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.

CWE(s)
CWE-326

Related Threats

CVEs Like This One

CVE-2025-30344Same product: Openslides Openslides
CVE-2024-22893Same product: Openslides Openslides
CVE-2025-30345Same product: Openslides Openslides
CVE-2026-25519Same product: Openslides Openslides
CVE-2025-30342Same product: Openslides Openslides
CVE-2025-30343Same product: Openslides Openslides
CVE-2023-23597Shared CWE-326
CVE-2023-21443Shared CWE-326
CVE-2023-47370Shared CWE-326
CVE-2024-39928Shared CWE-326

Affected Assets

openslides
openslides
4.0.15

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-13 Cryptographic Protection good match

SC-13 requires selection and implementation of specific cryptographic algorithms and key lengths, directly preventing use of inadequate encryption strength.

SC-12 Cryptographic Key Establishment and Management partial match

SC-12 governs cryptographic key establishment and management, which can enforce sufficient key sizes and thereby reduce inadequate encryption strength.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography partial match
blocks

Requiring the organization to define and enforce minimum cryptographic strength prevents deployment of insufficient key lengths or weak ciphers that can be brute-forced.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-326, a class-level weakness. Rules are authored against its narrower children: CWE-328.

References