title: SAML implementation allows privilege escalation
description:
In Blue Planet®  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.
Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
product: Inventory (BPI)
vendor: Blue Planet
versions:
lessThanOrEqual:  22.12, status: affected, version:  early versions , versionType: custom
status: unaffected, version:  21.10 MR11
status: unaffected, version:  22.02 MR5
status: unaffected, version:  22.08 MR4
}
{
defaultStatus: unaffected
product: Orchestration (BPO)
vendor: Blue Planet
versions:
lessThanOrEqual:  22.12, status: affected, version:  early versions , versionType: custom
status: unaffected, version:  22.02.03
status: unaffected, version:  22.08.05
status: unaffected, version:  22.12.02
}
{
defaultStatus: unaffected
product: Route Optimization and Analysis (ROA)
vendor: Blue Planet
versions:
lessThanOrEqual:  22.12, status: affected, version:  early versions , versionType: custom
status: unaffected, version:  22.02.P01.11-R
status: unaffected, version:  22.08.P01.1-R
status: unaffected, version:  22.12.P01.2.1-R
}
{
defaultStatus: unaffected
product: Unified Assurance and Analytics (UAA)
vendor: Blue Planet
versions:
lessThanOrEqual:  22.12, status: affected, version:  early versions , versionType: custom
status: unaffected, version:  22.02 MR5
status: unaffected, version:  22.12 MR2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Software patch to be applied