by Kastro CVE-2024-2005
Blue Planet Inventory (BPI) — SAML implementation allows privilege escalation
Description · from the CVE record
In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.
Affected
ProductAffectedFixed inSource
Inventory (BPI) early versions – 22.12–CNA
Orchestration (BPO) early versions – 22.12–CNA
Route Optimization and Analysis (ROA) early versions – 22.12–CNA
Unified Assurance and Analytics (UAA) early versions – 22.12–CNA
orchestration≤ 22.1222.02.03CISA-ADP
route_optimization_and_analysis≤ 22.1222.02.p01.11-rCISA-ADP
inventory≤ 22.1221.10_mr11CISA-ADP
unified_assurance_and_analytics≤ 22.1222.02_mr5CISA-ADP
Scores by source
Ciena (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total