CVE-2025-62399
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-11-14
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moodle | moodle | From 4.1.0 (inc) to 4.1.21 (exc) |
| moodle | moodle | From 4.4.0 (inc) to 4.4.11 (exc) |
| moodle | moodle | From 4.5.0 (inc) to 4.5.7 (exc) |
| moodle | moodle | From 5.0.0 (inc) to 5.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Moodle affects the mobile and web service authentication endpoints, which do not sufficiently restrict repeated password attempts. This means attackers can perform brute-force attacks by repeatedly guessing passwords for known usernames without being blocked or slowed down effectively. [1]
How can this vulnerability impact me? :
The vulnerability allows attackers to perform brute-force password attacks, potentially gaining unauthorized access to user accounts. This can lead to service disruption or compromise of user data, impacting the availability and security of the Moodle platform. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring authentication endpoints for repeated failed password attempts, indicating brute-force activity. You can analyze web server logs or Moodle logs for multiple failed login attempts from the same IP or user. Specific commands depend on your environment, but for example, using grep on log files to find repeated failed authentications: grep 'authentication failure' /path/to/moodle/logs/* | sort | uniq -c | sort -nr. Additionally, network monitoring tools can be used to detect unusual traffic patterns targeting the authentication endpoints. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Moodle to a fixed version: 5.0.3, 4.5.7, 4.4.11, or 4.1.21 or later. If upgrading is not immediately possible, implement rate limiting or throttling on the authentication endpoints to restrict repeated password attempts. Additionally, consider enabling account lockout policies after a number of failed attempts and monitoring for suspicious login activity. [1]