Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-67853

Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

moodle

Default version status: unaffected

  • 4.1.0 to < 4.1.22affected
  • 4.4.0 to < 4.4.12affected
  • 4.5.0 to < 4.5.8affected
  • 5.0.0 to < 5.0.4affected
  • 5.1.0 to < 5.1.1affected

References