A lack of rate limiting in the Moodle confirmation email service allows unauthenticated remote attackers to perform brute-force credential attacks against user accounts.

The software suffers from improper restriction of excessive authentication attempts (CWE-307) within its email confirmation service. This flaw enables an unauthenticated attacker to bypass standard security thresholds to enumerate or guess user credentials.

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk to organizational identity security. Successful exploitation allows for the unauthorized compromise of user accounts, which may lead to unauthorized data access, privilege escalation, and potential lateral movement within the Moodle environment.

Immediate Action: Update the Moodle installation to the latest available version (e.g., 4.1.22, 4.4.12, 4.5.8, 5.0.4, or 5.1.1) as specified in the vendor security release to resolve the rate limiting deficiency.

Proactive Monitoring: Review authentication and system logs for anomalous patterns of repeated requests or spikes in email confirmation activity originating from single IP addresses.

Compensating Controls: Implement rate limiting or blocking at the Web Application Firewall (WAF) level for the specific endpoints associated with the Moodle confirmation email service to mitigate brute-force attempts.

Public Exploit Available: No

Given the potential for large-scale brute-force attacks against user accounts, administrators should prioritize applying the provided patches. Organizations should treat this as a high-priority update to maintain the integrity of their authentication services and prevent unauthorized account access.