A vulnerability in Moodle authentication endpoints permits unauthenticated brute-force attacks, posing a significant risk to account security and system integrity.

This flaw is classified as an improper restriction of excessive authentication attempts (CWE-307), which allows unauthenticated remote attackers to repeatedly attempt password guesses against Moodle services.

The lack of effective rate limiting on authentication endpoints exposes the organization to account takeover risks, which can result in unauthorized access to sensitive educational or corporate data. While the CVSS score of 7.5 indicates a high severity, the primary risk involves the potential for credential stuffing or brute-forcing administrative or high-privilege accounts, leading to broader system compromise and reputational damage.

Immediate Action: Administrators must update their Moodle instances to the latest patched versions: 5.0.3, 4.5.7, 4.4.11, or 4.1.21, as specified by the vendor.

Proactive Monitoring: Security teams should review authentication logs for patterns of repeated failed login attempts originating from single IP addresses or anomalous geographic regions.

Compensating Controls: Deploy a Web Application Firewall (WAF) to implement rate-limiting rules and block suspicious traffic patterns targeting authentication endpoints.

Public Exploit Available: No confirmed public exploit exists in the provided data.

Given the high impact of unauthorized account access, it is imperative that organizations prioritize the application of the provided security patches. Failure to update leaves the authentication layer vulnerable to automated password guessing attacks, which are common vectors for initial system infiltration. Apply the recommended versions immediately to ensure full remediation.