CVE-2025-67853 — Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service

CVE-2025-67853

Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service PUBLISHED

Description (CNA)

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 4.1.0 before 4.1.22; affected 4.4.0 before 4.4.12; affected 4.5.0 before 4.5.8; affected 5.0.0 before 5.0.4; affected 5.1.0 before 5.1.1

CWE

CWE-307

References

https://access.redhat.com/security/cve/CVE-2025-67853
https://bugzilla.redhat.com/show_bug.cgi?id=2423847

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.