CVE-2025-62399

HIGH

Moodle 4.1.0-4.1.20 and 5.0.0-beta-5.0.2 - Brute-Force Attack via Authentication Endpoints

Title source: llm

Description

Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.

References (2)

Core 2

Core References

Third Party Advisory vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2025-62399

Issue Tracking, Third Party Advisory issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2404432

Scores

CVSS v3 7.5

EPSS 0.0035

EPSS Percentile 26.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-307

Status published

Products (2)

moodle/moodle 4.1.0 - 4.1.21

moodle/moodle 5.0.0-beta - 5.0.3Packagist

Published Oct 23, 2025

Tracked Since Feb 18, 2026