CVE-2024-30614: Ametys CMS Information Disclosure Flaw

CVE-2024-30614 Overview

CVE-2024-30614 is an information disclosure vulnerability affecting Ametys CMS versions 4.5.0 and earlier. The flaw allows unauthenticated remote attackers to obtain sensitive information through resources exposed to the error scope. The issue is classified under CWE-209: Generation of Error Message Containing Sensitive Information. Because exploitation requires no authentication or user interaction, any internet-facing Ametys CMS deployment is reachable by attackers probing error responses.

Critical Impact
Attackers can retrieve sensitive information from Ametys CMS without authentication by triggering error conditions that expose internal resources.

Affected Products

Ametys CMS version 4.5.0
All Ametys CMS versions prior to 4.5.0
Deployments using the default error handling scope

Discovery Timeline

2024-04-12 - CVE-2024-30614 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30614

Vulnerability Analysis

CVE-2024-30614 is an information disclosure flaw rooted in improper error handling within Ametys CMS. When the application encounters specific error conditions, it exposes resources scoped to error handling that should remain internal. Attackers can trigger these error states remotely and read data returned in the response.

The vulnerability is network-exploitable and requires no privileges or user interaction. The impact is limited to confidentiality, with no integrity or availability effects. Sensitive information such as internal paths, configuration fragments, or resource metadata may be returned through the error channel.

The issue affects the confidentiality of information handled by the CMS. It does not itself grant code execution or authentication bypass, but disclosed data can support reconnaissance for subsequent attacks against the same application or its underlying infrastructure.

Root Cause

The root cause is improper scoping of resources returned during error handling. Ametys CMS exposes resources associated with error responses that should not be reachable by unauthenticated clients. This falls under CWE-209, where error output contains data useful to an attacker.

Attack Vector

Exploitation is performed over the network by issuing crafted HTTP requests to the Ametys CMS instance. The attacker forces the application into an error state and reads the response, which returns resources tied to the error scope. No credentials, tokens, or user interaction are required. Details of the exposed behavior are documented in the GitHub Issue Discussion for CVE-2024-30614.

No verified proof-of-concept code is currently published. See the referenced issue for reproduction context.

Detection Methods for CVE-2024-30614

Indicators of Compromise

HTTP requests targeting known Ametys endpoints that consistently produce 4xx or 5xx responses with unusually large response bodies
Access log entries showing enumeration of nonexistent resources or malformed parameters designed to trigger error pages
Outbound crawling patterns from a single source hitting /plugins/, /_admin/, or error handler paths in short intervals

Detection Strategies

Inspect Ametys CMS error responses for internal path names, class names, or configuration fragments that should not be returned to unauthenticated users
Deploy web application firewall rules that flag repeated error-triggering requests against Ametys endpoints
Correlate application logs with edge logs to identify sources that repeatedly produce error conditions in the CMS

Monitoring Recommendations

Alert on spikes in HTTP 4xx and 5xx responses from Ametys CMS instances relative to baseline
Log and review the full request and response bodies for error paths, redacting any sensitive fields before storage
Track the User-Agent, source IP, and request cadence for clients that generate abnormal error rates

How to Mitigate CVE-2024-30614

Immediate Actions Required

Upgrade Ametys CMS to a version later than 4.5.0 that addresses the error scope exposure
Restrict administrative and plugin endpoints to trusted networks until the upgrade is applied
Review recent access logs for enumeration patterns and record any disclosed data as potentially compromised

Patch Information

The vendor tracks this issue in the GitHub Issue Discussion for CVE-2024-30614. Administrators should consult the Ametys project for the fixed release and apply it to all instances running 4.5.0 or earlier. No official vendor advisory URL is listed in the NVD record.

Workarounds

Configure the reverse proxy or WAF to strip verbose error content before returning responses to clients
Disable or override default error pages so that only generic messages are returned to unauthenticated users
Limit exposure of the Ametys CMS backend to the public internet by placing it behind authenticated access controls where feasible

bash

# Example nginx configuration to suppress verbose error responses
server {
    listen 443 ssl;
    server_name cms.example.com;

    proxy_intercept_errors on;
    error_page 400 401 403 404 500 502 503 504 /generic_error.html;

    location = /generic_error.html {
        internal;
        root /var/www/errors;
    }

    location / {
        proxy_pass http://ametys_backend;
    }
}