Vulnerability-Lookup

CVE-2024-2005 (GCVE-0-2024-2005)

Vulnerability from cvelistv5 – Published: 2024-03-05 18:54 – Updated: 2024-08-29 17:10

Title

SAML implementation allows privilege escalation

Summary

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.

Severity ?

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Assigner

Ciena

References

URL

Tags

https://www.ciena.com/product-security

Impacted products

Vendor

Product

Version

Blue Planet

Inventory (BPI)

Affected: early versions , ≤ 22.12 (custom)
Unaffected: 21.10 MR11
Unaffected: 22.02 MR5
Unaffected: 22.08 MR4

Blue Planet	Orchestration (BPO)	Affected: early versions , ≤ 22.12 (custom) Unaffected: 22.02.03 Unaffected: 22.08.05 Unaffected: 22.12.02
Blue Planet	Route Optimization and Analysis (ROA)	Affected: early versions , ≤ 22.12 (custom) Unaffected: 22.02.P01.11-R Unaffected: 22.08.P01.1-R Unaffected: 22.12.P01.2.1-R
Blue Planet	Unified Assurance and Analytics (UAA)	Affected: early versions , ≤ 22.12 (custom) Unaffected: 22.02 MR5 Unaffected: 22.12 MR2

Credits

Discovered by Prerit Chandok at Comcast

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:56:22.708Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ciena.com/product-security"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:blueplanet:orchestration:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "orchestration",
            "vendor": "blueplanet",
            "versions": [
              {
                "lessThanOrEqual": "22.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "22.02.03"
              },
              {
                "status": "unaffected",
                "version": "22.08.05"
              },
              {
                "status": "unaffected",
                "version": "22.12.02"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:blueplanet:route_optimization_and_analysis:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "route_optimization_and_analysis",
            "vendor": "blueplanet",
            "versions": [
              {
                "lessThanOrEqual": "22.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "22.02.p01.11-r"
              },
              {
                "status": "unaffected",
                "version": "22.08.p01.1-r"
              },
              {
                "status": "unaffected",
                "version": "22.12.p01.2.1-r"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:blueplanet:inventory:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "inventory",
            "vendor": "blueplanet",
            "versions": [
              {
                "lessThanOrEqual": "22.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "21.10_mr11"
              },
              {
                "status": "unaffected",
                "version": "22.02_mr5"
              },
              {
                "status": "unaffected",
                "version": "22.08_mr4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:blueplanet:unified_assurance_and_analytics:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "unified_assurance_and_analytics",
            "vendor": "blueplanet",
            "versions": [
              {
                "lessThanOrEqual": "22.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "22.02_mr5"
              },
              {
                "status": "unaffected",
                "version": "22.12_mr2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T16:53:33.497826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T17:10:16.253Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Inventory (BPI)",
          "vendor": "Blue Planet",
          "versions": [
            {
              "lessThanOrEqual": " 22.12",
              "status": "affected",
              "version": " early versions ",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": " 21.10 MR11"
            },
            {
              "status": "unaffected",
              "version": " 22.02 MR5"
            },
            {
              "status": "unaffected",
              "version": " 22.08 MR4"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Orchestration (BPO)",
          "vendor": "Blue Planet",
          "versions": [
            {
              "lessThanOrEqual": " 22.12",
              "status": "affected",
              "version": " early versions ",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": " 22.02.03"
            },
            {
              "status": "unaffected",
              "version": " 22.08.05"
            },
            {
              "status": "unaffected",
              "version": " 22.12.02"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Route Optimization and Analysis (ROA)",
          "vendor": "Blue Planet",
          "versions": [
            {
              "lessThanOrEqual": " 22.12",
              "status": "affected",
              "version": " early versions ",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": " 22.02.P01.11-R"
            },
            {
              "status": "unaffected",
              "version": " 22.08.P01.1-R"
            },
            {
              "status": "unaffected",
              "version": " 22.12.P01.2.1-R"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Unified Assurance and Analytics (UAA) ",
          "vendor": "Blue Planet",
          "versions": [
            {
              "lessThanOrEqual": " 22.12",
              "status": "affected",
              "version": " early versions ",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": " 22.02 MR5"
            },
            {
              "status": "unaffected",
              "version": " 22.12 MR2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Discovered by Prerit Chandok at Comcast"
        }
      ],
      "datePublic": "2024-03-04T17:07:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eIn Blue Planet\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\u003cbr\u003e\u003cbr\u003eBlue Planet\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\u003cbr\u003e\u003c/p\u003e\n\n\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\n\n\n\n\n\n"
            }
          ],
          "value": "\nIn Blue Planet\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\n\nBlue Planet\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-03T16:34:59.282Z",
        "orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
        "shortName": "Ciena"
      },
      "references": [
        {
          "url": "https://www.ciena.com/product-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\nSoftware patch to be applied\u003cbr\u003e"
            }
          ],
          "value": "\nSoftware patch to be applied\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SAML implementation allows privilege escalation",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
    "assignerShortName": "Ciena",
    "cveId": "CVE-2024-2005",
    "datePublished": "2024-03-05T18:54:00.839Z",
    "dateReserved": "2024-02-29T11:16:19.384Z",
    "dateUpdated": "2024-08-29T17:10:16.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.ciena.com/product-security\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T18:56:22.708Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-2005\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-29T16:53:33.497826Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:blueplanet:orchestration:*:*:*:*:*:*:*:*\"], \"vendor\": \"blueplanet\", \"product\": \"orchestration\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"22.12\"}, {\"status\": \"unaffected\", \"version\": \"22.02.03\"}, {\"status\": \"unaffected\", \"version\": \"22.08.05\"}, {\"status\": \"unaffected\", \"version\": \"22.12.02\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:blueplanet:route_optimization_and_analysis:*:*:*:*:*:*:*:*\"], \"vendor\": \"blueplanet\", \"product\": \"route_optimization_and_analysis\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"22.12\"}, {\"status\": \"unaffected\", \"version\": \"22.02.p01.11-r\"}, {\"status\": \"unaffected\", \"version\": \"22.08.p01.1-r\"}, {\"status\": \"unaffected\", \"version\": \"22.12.p01.2.1-r\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:blueplanet:inventory:*:*:*:*:*:*:*:*\"], \"vendor\": \"blueplanet\", \"product\": \"inventory\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"22.12\"}, {\"status\": \"unaffected\", \"version\": \"21.10_mr11\"}, {\"status\": \"unaffected\", \"version\": \"22.02_mr5\"}, {\"status\": \"unaffected\", \"version\": \"22.08_mr4\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:blueplanet:unified_assurance_and_analytics:*:*:*:*:*:*:*:*\"], \"vendor\": \"blueplanet\", \"product\": \"unified_assurance_and_analytics\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"22.12\"}, {\"status\": \"unaffected\", \"version\": \"22.02_mr5\"}, {\"status\": \"unaffected\", \"version\": \"22.12_mr2\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-29T17:09:28.206Z\"}}], \"cna\": {\"title\": \"SAML implementation allows privilege escalation\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Discovered by Prerit Chandok at Comcast\"}], \"impacts\": [{\"capecId\": \"CAPEC-233\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-233 Privilege Escalation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Blue Planet\", \"product\": \"Inventory (BPI)\", \"versions\": [{\"status\": \"affected\", \"version\": \" early versions \", \"versionType\": \"custom\", \"lessThanOrEqual\": \" 22.12\"}, {\"status\": \"unaffected\", \"version\": \" 21.10 MR11\"}, {\"status\": \"unaffected\", \"version\": \" 22.02 MR5\"}, {\"status\": \"unaffected\", \"version\": \" 22.08 MR4\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Blue Planet\", \"product\": \"Orchestration (BPO)\", \"versions\": [{\"status\": \"affected\", \"version\": \" early versions \", \"versionType\": \"custom\", \"lessThanOrEqual\": \" 22.12\"}, {\"status\": \"unaffected\", \"version\": \" 22.02.03\"}, {\"status\": \"unaffected\", \"version\": \" 22.08.05\"}, {\"status\": \"unaffected\", \"version\": \" 22.12.02\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Blue Planet\", \"product\": \"Route Optimization and Analysis (ROA)\", \"versions\": [{\"status\": \"affected\", \"version\": \" early versions \", \"versionType\": \"custom\", \"lessThanOrEqual\": \" 22.12\"}, {\"status\": \"unaffected\", \"version\": \" 22.02.P01.11-R\"}, {\"status\": \"unaffected\", \"version\": \" 22.08.P01.1-R\"}, {\"status\": \"unaffected\", \"version\": \" 22.12.P01.2.1-R\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Blue Planet\", \"product\": \"Unified Assurance and Analytics (UAA) \", \"versions\": [{\"status\": \"affected\", \"version\": \" early versions \", \"versionType\": \"custom\", \"lessThanOrEqual\": \" 22.12\"}, {\"status\": \"unaffected\", \"version\": \" 22.02 MR5\"}, {\"status\": \"unaffected\", \"version\": \" 22.12 MR2\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"\\nSoftware patch to be applied\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\\n\\nSoftware patch to be applied\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-03-04T17:07:00.000Z\", \"references\": [{\"url\": \"https://www.ciena.com/product-security\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"\\nIn Blue Planet\\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\\n\\nBlue Planet\\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\\n\\n\u003c/p\u003e\u003cp\u003eIn Blue Planet\\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\u003cbr\u003e\u003cbr\u003eBlue Planet\\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\u003cbr\u003e\u003c/p\u003e\\n\\n\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\\n\\n\\n\\n\\n\\n\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\", \"shortName\": \"Ciena\", \"dateUpdated\": \"2024-04-03T16:34:59.282Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-2005\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-29T17:10:16.253Z\", \"dateReserved\": \"2024-02-29T11:16:19.384Z\", \"assignerOrgId\": \"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\", \"datePublished\": \"2024-03-05T18:54:00.839Z\", \"assignerShortName\": \"Ciena\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-2005

Vulnerability from fkie_nvd - Published: 2024-03-06 12:15 - Updated: 2025-11-13 16:42

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	7bd90cf1-1651-495e-9ae8-9415fb3c9feb	https://www.ciena.com/product-security	Not Applicable
	af854a3a-2127-422b-91ae-364da2661108	https://www.ciena.com/product-security	Not Applicable

Impacted products

	Vendor	Product	Version
	ciena	blue_planet_inventory	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ciena:blue_planet_inventory:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1185C6C2-F148-4909-8BA1-63E511A46851",
              "versionEndIncluding": "22.12",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nIn Blue Planet\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\n\nBlue Planet\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\n\n"
    },
    {
      "lang": "es",
      "value": "En los productos Blue Planet\u00ae hasta la versi\u00f3n 22.12, una mala configuraci\u00f3n en la implementaci\u00f3n de SAML permite la escalada de privilegios. S\u00f3lo se ven afectados los productos que utilizan autenticaci\u00f3n SAML. Blue Planet\u00ae ha lanzado actualizaciones de software que abordan esta vulnerabilidad para los productos afectados. Se recomienda a los clientes que actualicen sus productos Blue Planet a la \u00faltima versi\u00f3n del software lo antes posible. Las actualizaciones de software se pueden descargar desde el Portal de soporte de Ciena."
    }
  ],
  "id": "CVE-2024-2005",
  "lastModified": "2025-11-13T16:42:15.917",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-03-06T12:15:45.827",
  "references": [
    {
      "source": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.ciena.com/product-security"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.ciena.com/product-security"
    }
  ],
  "sourceIdentifier": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2024-2005

Vulnerability from gsd - Updated: 2024-03-01 06:03

Details

Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.

Aliases

CVE-2024-2005

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-2005"
      ],
      "details": "\n\n\nBlue Planet\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\n\n\n\n\n\n\n\n\n\n\n\n\n\n",
      "id": "GSD-2024-2005",
      "modified": "2024-03-01T06:03:00.832903Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@ciena.com",
        "ID": "CVE-2024-2005",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Inventory (BPI)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThanOrEqual": " 22.12",
                                "status": "affected",
                                "version": " early versions ",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": " 21.10 MR11"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.02 MR5"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.08 MR4"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Orchestration (BPO)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThanOrEqual": " 22.12",
                                "status": "affected",
                                "version": " early versions ",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.02.03"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.08.05"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.12.02"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Route Optimization and Analysis (ROA)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThanOrEqual": " 22.12",
                                "status": "affected",
                                "version": " early versions ",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.02.P01.11-R"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.08.P01.1-R"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.12.P01.2.1-R"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Unified Assurance and Analytics (UAA) ",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThanOrEqual": " 22.12",
                                "status": "affected",
                                "version": " early versions ",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.02 MR5"
                              },
                              {
                                "status": "unaffected",
                                "version": " 22.12 MR2"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Blue Planet"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Discovered by Prerit Chandok at Comcast"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "\nIn Blue Planet\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\n\nBlue Planet\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-269",
                "lang": "eng",
                "value": "CWE-269 Improper Privilege Management"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.ciena.com/product-security",
            "refsource": "MISC",
            "url": "https://www.ciena.com/product-security"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\nSoftware patch to be applied\u003cbr\u003e"
            }
          ],
          "value": "\nSoftware patch to be applied\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "\nIn Blue Planet\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\n\nBlue Planet\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.\n\n"
          },
          {
            "lang": "es",
            "value": "En los productos Blue Planet\u00ae hasta la versi\u00f3n 22.12, una mala configuraci\u00f3n en la implementaci\u00f3n de SAML permite la escalada de privilegios. S\u00f3lo se ven afectados los productos que utilizan autenticaci\u00f3n SAML. Blue Planet\u00ae ha lanzado actualizaciones de software que abordan esta vulnerabilidad para los productos afectados. Se recomienda a los clientes que actualicen sus productos Blue Planet a la \u00faltima versi\u00f3n del software lo antes posible. Las actualizaciones de software se pueden descargar desde el Portal de soporte de Ciena."
          }
        ],
        "id": "CVE-2024-2005",
        "lastModified": "2024-04-03T17:15:55.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 6.0,
              "source": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-03-06T12:15:45.827",
        "references": [
          {
            "source": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
            "url": "https://www.ciena.com/product-security"
          }
        ],
        "sourceIdentifier": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-269"
              }
            ],
            "source": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

GHSA-J7P2-M4FF-PW4R

Vulnerability from github – Published: 2024-03-06 12:30 – Updated: 2025-11-13 18:30

Details

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.

Severity ?

9.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-2005"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-06T12:15:45Z",
    "severity": "CRITICAL"
  },
  "details": "In Blue Planet\u00ae  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.\n\nBlue Planet\u00ae has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.",
  "id": "GHSA-j7p2-m4ff-pw4r",
  "modified": "2025-11-13T18:30:59Z",
  "published": "2024-03-06T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2005"
    },
    {
      "type": "WEB",
      "url": "https://www.ciena.com/product-security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-2005 (GCVE-0-2024-2005)

FKIE_CVE-2024-2005

GSD-2024-2005

GHSA-J7P2-M4FF-PW4R

Tags

Sightings

Nomenclature