CVE-2024-22892: 
Python vulnerability analysis and mitigation

OpenSlides 4.0.15 was discovered to contain a security vulnerability related to weak password hashing. The vulnerability was identified on November 19, 2023, confirmed by the vendor on November 20, 2023, and fixed in OpenSlides 4.0.16 on November 23, 2023. The public disclosure was made on September 25, 2024 (GitHub Advisory).

The vulnerability stems from the implementation of password hashing in OpenSlides 4.0.15, where passwords are hashed using a single round of SHA-512 with salt. This implementation has been classified as having inadequate encryption strength with a CVSS v3.1 base score of 7.5 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The weakness is categorized under CWE-326 (Inadequate Encryption Strength) (NVD).

Attackers who gain access to the hashed passwords can potentially calculate the cleartext passwords within a very short time period using massively-parallel computing resources such as cloud computing, GPU, ASIC, or FPGA hardware (GitHub Advisory).

The vulnerability has been addressed in OpenSlides version 4.0.16. Users are advised to upgrade to this version to mitigate the risk (GitHub Advisory).