CVE-2025-62399
Moodle: password brute force risk when mobile/web services enabled
Summary
Moodle: password brute force risk when mobile/web services enabled
Original description
The description as published by the source.
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.21"},{"introduced":"4.4.0"},{"fixed":"4.4.11"},{"introduced":"4.5.0"},{"fixed":"4.5.7"},{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]
References
- advisory access.redhat.com
- advisory nvd.nist.gov
- advisory github.com
- report bugzilla.redhat.com
- web git.moodle.org