What’s Vulnerable › Vulnerabilities
CVE-2025-30344
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-21 · updated 2026-06-17
- Weakness: CWE-208
Description
An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password (e.g., more than 100 milliseconds).
Affected products
- Intevation OpenSlides: before 4.2.5 — fixed in 4.2.5
How to fix
Upgrade to a fixed version: Intevation OpenSlides 4.2.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-30344 or the next vulnerability affects your stack