GitHub Advisoryadvisory · Maven

GHSA-fxp5-37mh-vff5 BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources

MEDIUM Published 2025-12-03 Modified 2025-12-03 Official page ↗
Aliases
CVE-2025-13472
Ecosystem
Maven
Packages
com.blazemeter.plugins:BlazeMeterJenkinsPlugin
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2025-12-03

Affected packages

• Maven com.blazemeter.plugins:BlazeMeterJenkinsPlugin: < 4.27 → fixed in 4.27

Description

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

Related

Alias · CVE (1)

  • CVE-2025-13472 A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References