CVE-2024-2005 — SAML implementation allows privilege escalation

Back Back to CVE browser

CRITICAL

SAML implementation allows privilege escalation

Published Mar 5, 2024

9.0

CRITICAL

CVSS 3.1

EPSS 0.45%

Description

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.

Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.

Affected products

Vendor Blue Planet Product Inventory (BPI) Default
unaffected
- Version
  early versions
  Status
  affected
  Constraints
  <=22.12
- Version
  21.10 MR11
  Status
  unaffected
  Constraints
  -
- Version
  22.02 MR5
  Status
  unaffected
  Constraints
  -
- Version
  22.08 MR4
  Status
  unaffected
  Constraints
  -
Vendor Blue Planet Product Orchestration (BPO) Default
unaffected
- Version
  early versions
  Status
  affected
  Constraints
  <=22.12
- Version
  22.02.03
  Status
  unaffected
  Constraints
  -
- Version
  22.08.05
  Status
  unaffected
  Constraints
  -
- Version
  22.12.02
  Status
  unaffected
  Constraints
  -
Vendor Blue Planet Product Route Optimization and Analysis (ROA) Default
unaffected
- Version
  early versions
  Status
  affected
  Constraints
  <=22.12
- Version
  22.02.P01.11-R
  Status
  unaffected
  Constraints
  -
- Version
  22.08.P01.1-R
  Status
  unaffected
  Constraints
  -
- Version
  22.12.P01.2.1-R
  Status
  unaffected
  Constraints
  -
Vendor Blue Planet Product Unified Assurance and Analytics (UAA) Default
unaffected
- Version
  early versions
  Status
  affected
  Constraints
  <=22.12
- Version
  22.02 MR5
  Status
  unaffected
  Constraints
  -
- Version
  22.12 MR2
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Blue Planet

Inventory (BPI)

unaffected

Version	Status	Constraints
early versions	affected	<=22.12
21.10 MR11	unaffected	-
22.02 MR5	unaffected	-
22.08 MR4	unaffected	-

Blue Planet

Orchestration (BPO)

unaffected

Version	Status	Constraints
early versions	affected	<=22.12
22.02.03	unaffected	-
22.08.05	unaffected	-
22.12.02	unaffected	-

Blue Planet

Route Optimization and Analysis (ROA)

unaffected

Version	Status	Constraints
early versions	affected	<=22.12
22.02.P01.11-R	unaffected	-
22.08.P01.1-R	unaffected	-
22.12.P01.2.1-R	unaffected	-

Blue Planet

Unified Assurance and Analytics (UAA)

unaffected

Version	Status	Constraints
early versions	affected	<=22.12
22.02 MR5	unaffected	-
22.12 MR2	unaffected	-

Vendor Blueplanet Product Inventory Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=22.12
- Version
  21.10_mr11
  Status
  unaffected
  Constraints
  -
- Version
  22.02_mr5
  Status
  unaffected
  Constraints
  -
- Version
  22.08_mr4
  Status
  unaffected
  Constraints
  -
Vendor Blueplanet Product Orchestration Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=22.12
- Version
  22.02.03
  Status
  unaffected
  Constraints
  -
- Version
  22.08.05
  Status
  unaffected
  Constraints
  -
- Version
  22.12.02
  Status
  unaffected
  Constraints
  -
Vendor Blueplanet Product Route Optimization and Analysis Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=22.12
- Version
  22.02.p01.11-r
  Status
  unaffected
  Constraints
  -
- Version
  22.08.p01.1-r
  Status
  unaffected
  Constraints
  -
- Version
  22.12.p01.2.1-r
  Status
  unaffected
  Constraints
  -
Vendor Blueplanet Product Unified Assurance and Analytics Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=22.12
- Version
  22.02_mr5
  Status
  unaffected
  Constraints
  -
- Version
  22.12_mr2
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Blueplanet

Inventory

unaffected

Version	Status	Constraints
0	affected	<=22.12
21.10_mr11	unaffected	-
22.02_mr5	unaffected	-
22.08_mr4	unaffected	-

Blueplanet

Orchestration

unaffected

Version	Status	Constraints
0	affected	<=22.12
22.02.03	unaffected	-
22.08.05	unaffected	-
22.12.02	unaffected	-

Blueplanet

Route Optimization and Analysis

unaffected

Version	Status	Constraints
0	affected	<=22.12
22.02.p01.11-r	unaffected	-
22.08.p01.1-r	unaffected	-
22.12.p01.2.1-r	unaffected	-

Blueplanet

Unified Assurance and Analytics

unaffected

Version	Status	Constraints
0	affected	<=22.12
22.02_mr5	unaffected	-
22.12_mr2	unaffected	-

Remediation

Vendor solution

Software patch to be applied

Metrics

0.45% 0.00453

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00453

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (6 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.45% (0.00453)	37.04th	v5 (v2026.06.15)
Jun 15, 2026	0.45% (0.00453)	35.77th	v5 (v2026.06.15)
Mar 17, 2025	0.19% (0.00192)	39.01th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00043)	10.81th	v3 (v2023.03.01)
Jun 21, 2024	0.04% (0.00043)	9.04th	v3 (v2023.03.01)
Mar 6, 2024	0.04% (0.00043)	7.03th	v3 (v2023.03.01)