Authentication Bypass in Navigator and Blue Planet Products
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CIENA | Navigator NCS | unaffected |
|
|||||||||||||||
| CIENA | MCP | unaffected |
|
|||||||||||||||
| CIENA | Planner Plus OnPrem | unaffected |
|
|||||||||||||||
| Blue Planet | Inventory | unaffected |
|
|||||||||||||||
| Blue Planet | Orchestration | unaffected |
|
|||||||||||||||
| Blue Planet | Route Optimization & Analysis | unaffected |
|
|||||||||||||||
| Blue Planet | Unified Assurance & Analytics | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Blue Planet | Inventory |
|
||||||||||||||||||||
| Blue Planet | Orchestration |
|
||||||||||||||||||||
| Blue Planet | Route Optimization & Analysis |
|
||||||||||||||||||||
| Blue Planet | Unified Assurance & Analytics |
|
||||||||||||||||||||
| Ciena | Mcp |
|
||||||||||||||||||||
| Ciena | Navigator Ncs |
|
||||||||||||||||||||
| Ciena | Planner Plus Onprem |
|
Vendor Solution
Ciena recommends upgrading to the latest available remediated release. For additional details, refer to myciena.com for current software versions, fixes, and security advisories. Remediation and Fixes: Products Remediated Version BP Inventory >=24.08, 24.04.100, 23.12.500, 23.08.400, 23.04.800 BP Orchestration >=24.08, 24.04.3 MR3, 23.12.4 MR4, 23.08.5 MR5, 23.04.4 MR3 BP Route Optimization & Analysis >=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, 23.04.P02-1-R BP Unified Assurance & Analytics >=24.08, 24.04.MR2, 23.12.MR4 Navigator NCS >= 8.2, 8.1-P02 MCP 8.0-P04, 7.2-P07 Planner Plus OnPrem >= 4.2, 4.1-P01
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.664% probability within 30 days)
| Link | Providers |
|---|---|
| https://www.ciena.com/product-security |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Blue Planet
Blue Planet inventory Blue Planet orchestration Blue Planet route Optimization & Analysis Blue Planet unified Assurance & Analytics Ciena Ciena mcp Ciena navigator Ncs Ciena planner Plus Onprem |
|
| Vendors & Products |
Blue Planet
Blue Planet inventory Blue Planet orchestration Blue Planet route Optimization & Analysis Blue Planet unified Assurance & Analytics Ciena Ciena mcp Ciena navigator Ncs Ciena planner Plus Onprem |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls. | |
| Title | Authentication Bypass in Navigator and Blue Planet Products | |
| Weaknesses | CWE-287 | |
| References |
|