high7.5
CVE-2025-67853
Moodle Affected by Improper Restriction of Excessive Authentication Attempts
Impact
A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | < 4.1.22 | 4.1.22 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | before 4.1.22 from 4.4.0 before 4.4.11 from 4.5.0 before 4.5.8 from 5.0.0 before 5.0.4 Version 5.1.0 |