CVE-2025-67853: Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service
A brute-force facilitation issue was present in the confirmation email service. Without proper rate limiting, this endpoint could help attackers enumerate or guess credentials with less resistance.
Other sources
A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67853?
CVE-2025-67853 is considered a moderate severity vulnerability due to its potential for facilitating brute-force attacks.
How do I fix CVE-2025-67853?
To fix CVE-2025-67853, update to Moodle version 5.1.1, 5.0.4, 4.5.8, 4.4.12, or the latest available version.
What is the impact of CVE-2025-67853?
The impact of CVE-2025-67853 allows attackers to enumerate or guess user credentials more easily due to the lack of rate limiting.
Which versions of Moodle are affected by CVE-2025-67853?
CVE-2025-67853 affects Moodle versions prior to 5.1.1, 5.0.4, 4.5.8, and 4.4.12.
Is there a workaround for CVE-2025-67853?
There is no specific workaround for CVE-2025-67853; the recommended action is to apply the available software updates.