Privilege escalation in Blue Planet Inventory (Bpi)
CVE-2024-2005
In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.
Vulnerability class: Privilege Escalation
EPSS: 0.005 (37.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Blue Planet Inventory (Bpi) — versions early versions , 21.10 MR11, 22.02 MR5
- Blue Planet Orchestration (Bpo) — versions early versions , 22.02.03, 22.08.05
- Blue Planet Route Optimization And Analysis (Roa) — versions early versions , 22.02.P01.11-R, 22.08.P01.1-R
- Blue Planet Unified Assurance And Analytics (Uaa) — versions early versions , 22.02 MR5, 22.12 MR2
- Ciena Blue_planet_inventory
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 7bd90cf1-1651-495e-9ae8-9415fb3c9feb (Not Applicable)
Frequently asked questions
- What is CVE-2024-2005?
- CVE-2024-2005 is a critical-severity vulnerability in Blue Planet Inventory (Bpi), classified under Improper Privilege Management. CVSS score: 9.0/10. Published 2024-03-06.
- How severe is CVE-2024-2005?
- Critical severity. CVSS v3 base score is 9.0 out of 10.
- Is CVE-2024-2005 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.