Threat Investigation
Request a demo

CVE-2025-13472

Medium

Description

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

SeverityMedium
CVSS5.3
Exploit probability—
ProductCom.blazemeter.plugins:blazemeterjenkinsplugin
PublishedDec 3, 2025
First seenDec 3, 2025
Weakness typeCWE-862Missing authorization

How to fix

Update
  • com.blazemeter.plugins:BlazeMeterJenkinsPlugin4.27 or later

Affected products

ProductAffected versionsFixed in
com.blazemeter.plugins:BlazeMeterJenkinsPluginMavenv < 4.274.27

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.