PT-2025-43447 · Moodle · Moodle

Published 2025-10-23 · Updated 2025-11-17 · CVE-2025-62399

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The authentication endpoints for Moodle’s mobile and web services did not adequately limit repeated password attempts, leaving them open to brute-force attacks. The vulnerable endpoints are the mobile and web service authentication endpoints. The issue involves insufficient restriction of password attempts, potentially allowing attackers to guess valid credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BIT-MOODLE-2025-62399

CVE-2025-62399

GHSA-M58F-9PVV-8MP2

Affected Products

Moodle

References · 17

• https://osv.dev/vulnerability/BIT-moodle-2025-62399 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62399 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m58f-9pvv-8mp2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62399 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-62399 · Security Note
• https://ubuntu.com/security/CVE-2025-62399 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/e4d02567c922c537086de9f59f063ca073552a3a · Note
• https://moodle.org/mod/forum/discuss.php?d=470388 · Note
• https://twitter.com/ZeroPathLabs/status/1981340453338296560 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981341039848804641 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-62399 · Note
• https://t.me/CVEtracker/35564 · Telegram Post
• https://twitter.com/cracbot/status/1983126640948556085 · Twitter Post