Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2024-2005

SAML implementation allows privilege escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Ciena

Description

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Blue Planet Inventory (BPI)

Default version status: unaffected

  • early versions to ≤ 22.12affected
  • 21.10 MR11unaffected
  • 22.02 MR5unaffected
  • 22.08 MR4unaffected

Blue Planet Orchestration (BPO)

Default version status: unaffected

  • early versions to ≤ 22.12affected
  • 22.02.03unaffected
  • 22.08.05unaffected
  • 22.12.02unaffected

Blue Planet Route Optimization and Analysis (ROA)

Default version status: unaffected

  • early versions to ≤ 22.12affected
  • 22.02.P01.11-Runaffected
  • 22.08.P01.1-Runaffected
  • 22.12.P01.2.1-Runaffected

Blue Planet Unified Assurance and Analytics (UAA)

Default version status: unaffected

  • early versions to ≤ 22.12affected
  • 22.02 MR5unaffected
  • 22.12 MR2unaffected

References