CVE-2025-67853 - Vulnerability Details - OpenCVE

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2025-67853
https://bugzilla.redhat.com/show_bug.cgi?id=2423847

History

Tue, 03 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 03 Feb 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.
Title		Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service
Weaknesses		CWE-307
References		https://access.redhat.com/security/cve/CVE-2025-67853 https://bugzilla.redhat.com/show_bug.cgi?id=2423847
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2026-02-03T10:52:12.755Z

Updated: 2026-02-03T15:43:49.951Z

Reserved: 2025-12-12T13:00:24.330Z

Link: CVE-2025-67853

Vulnrichment

Updated: 2026-02-03T15:43:46.563Z

NVD

Status : Awaiting Analysis

Published: 2026-02-03T11:15:55.663

Modified: 2026-02-03T16:44:03.343

Link: CVE-2025-67853

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-307

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67853", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2025-12-12T13:00:24.330Z", "datePublished": "2026-02-03T10:52:12.755Z", "dateUpdated": "2026-02-03T15:43:49.951Z"}, "containers": {"cna": {"title": "Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts."}], "affected": [{"versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.1.22", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.12", "versionType": "semver"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.8", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThan": "5.1.1", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://github.com/moodle/moodle/", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-67853", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423847", "name": "RHBZ#2423847", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2025-12-15T04:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "timeline": [{"lang": "en", "time": "2025-12-19T12:15:54.071000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-15T04:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Petr Skoda for reporting this issue."}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2026-02-03T10:52:12.755Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T15:43:42.458056Z", "id": "CVE-2025-67853", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:43:49.951Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67853", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T15:43:42.458056Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:43:46.563Z"}}], "cna": {"title": "Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service", "credits": [{"lang": "en", "value": "Red Hat would like to thank Petr Skoda for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.1.22", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.12", "versionType": "semver"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.8", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThan": "5.1.1", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://github.com/moodle/moodle/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-19T12:15:54.071000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-15T04:00:00+00:00", "value": "Made public."}], "datePublic": "2025-12-15T04:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-67853", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423847", "name": "RHBZ#2423847", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2026-02-03T10:52:12.755Z"}, "x_redhatCweChain": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}}, "cveMetadata": {"cveId": "CVE-2025-67853", "state": "PUBLISHED", "dateUpdated": "2026-02-03T15:43:49.951Z", "dateReserved": "2025-12-12T13:00:24.330Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2026-02-03T10:52:12.755Z", "assignerShortName": "fedora"}, "dataVersion": "5.2"}