7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62399

CVE-2025-62399: Moodle vulnerable to brute-force password guesses

Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62399

CVE-2025-62399:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	>= 5.0.0-beta, < 5.0.3	5.0.3
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.7	4.5.7
moodle/moodle	composer	>= 4.2.0-beta, < 4.4.11	4.4.11
moodle/moodle	composer	< 4.1.21	4.1.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security patch (commit e4d02567c922c537086de9f59f063ca073552a3a) points directly to the user_login_webservice function in public/auth/webservice/auth.php as the source of the vulnerability. The vulnerability description states that Moodle's web service authentication endpoints were susceptible to brute-force attacks due to insufficient restrictions. The commit diff shows that the logic for retrieving a user during the login process was made more stringent. Previously, the code only checked for a matching username. The patch adds checks to ensure the user account is active, not suspended, and specifically enabled for web service authentication ('auth' => 'webservice'). This change directly addresses the reported vulnerability by narrowing the scope of users against whom a password can be tested, thus mitigating the brute-force risk. The function user_login_webservice is the entry point for this flawed authentication flow and would be the primary function appearing in a profiler during an exploitation attempt.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.