CVE-2025-13472 — Missing Authorization in Blazemeter

CWE-862 — Missing Authorization4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 81.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Perforce BlazemeterJenkins Blazemeter PluginJenkins Coverage Plugin+6 more
Timeline
PublishedDec 3
Latest updateDec 10

Description

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages9 packages

🔴Vulnerability Details

2
OSV
BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources↗2025-12-03
▶
GHSA
BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources↗2025-12-03
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2025-12-10↗2025-12-10
▶