Moodle Rate Limiting Vulnerability in Confirmation Email Service Facilitates Brute-Force Attacks

A vulnerability in Moodle's confirmation email service allows remote attackers to exploit inadequate rate limiting. This flaw can be used to more easily enumerate or guess user credentials, thereby facilitating brute-force attacks on user accounts.

Impact

The lack of proper rate limiting can lead to increased success in brute-force attacks, allowing attackers to gain unauthorized access to user accounts by guessing passwords.