CVE-2024-2005

SAML implementation allows privilege escalation

State: Published
Severity: 9.0 Critical
Published: Mar 5, 2024
Updated: Aug 29, 2024
Reserved: Feb 29, 2024

Description

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.

Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	Ciena

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
Inventory (BPI)Blue Planet	early versions through 22.12Affected 21.10 MR11Not affected 22.02 MR5Not affected 22.08 MR4Not affected
Orchestration (BPO)Blue Planet	early versions through 22.12Affected 22.02.03Not affected 22.08.05Not affected 22.12.02Not affected
Route Optimization and Analysis (ROA)Blue Planet	early versions through 22.12Affected 22.02.P01.11-RNot affected 22.08.P01.1-RNot affected 22.12.P01.2.1-RNot affected
Unified Assurance and Analytics (UAA)Blue Planet	early versions through 22.12Affected 22.02 MR5Not affected 22.12 MR2Not affected

References

https://www.ciena.com/product-security

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.