Moodle Authentication Endpoints Brute-Force Vulnerability

A vulnerability exists in Moodle's mobile and web service authentication endpoints, which fail to adequately limit repeated password attempts. This oversight creates a risk of brute-force attacks, allowing attackers to systematically guess passwords for known usernames. The vulnerability affects Moodle versions 5.0 prior to 5.0.3, 4.5 prior to 4.5.7, 4.4 prior to 4.4.11, 4.1 prior to 4.1.21, and earlier unsupported versions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user accounts through successful password guessing via brute-force methods.

Remediation

Users can upgrade to Moodle versions 5.0.3, 4.5.7, 4.4.11, or 4.1.21 to address this vulnerability.