A vulnerability in LimeSurvey 6.13.0 allows unauthenticated attackers to perform a Denial of Service attack by triggering an infinite HTTP redirect loop.

This vulnerability involves a logic flaw in the /optout endpoint, categorized as an infinite loop with an unreachable exit condition (CWE-835). The issue is remotely exploitable by unauthenticated attackers, as it requires no prior user privileges or interaction to trigger.

The vulnerability poses a risk to service availability, as the resulting infinite redirect loop can exhaust server or client resources, leading to service degradation or browser instability. With a CVSS score of 7.5, this high severity rating reflects the ease of exploitation and the potential for disrupting critical survey operations. Organizations relying on LimeSurvey for data collection may face significant operational downtime if this flaw is exploited against their infrastructure.

Immediate Action: Upgrade LimeSurvey to version 6.15.0 or later to apply the official fix provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous, repetitive requests targeting the /optout endpoint or patterns indicative of high-frequency redirect loops.

Compensating Controls: Implement rate limiting on the web server or utilize a Web Application Firewall (WAF) to block or throttle requests to the /optout path until the update can be applied.

Public Exploit Available: No

Given the potential for service disruption and the lack of authentication required to trigger this flaw, administrators should prioritize updating their LimeSurvey instances. Applying the fix to version 6.15.0 is the only definitive way to resolve the underlying redirect logic error and ensure continued system stability.