PT-2025-48800 · Jenkins · Blazemeter Jenkins Plugin

Published 2025-12-03 · Updated 2025-12-05 · CVE-2025-13472

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions BlazeMeter Jenkins Plugin versions prior to 4.27

Description A flaw existed in the BlazeMeter Jenkins Plugin that allowed unauthorized users to view a list of available resources, including credential IDs, bzm workspaces, and bzm project IDs, through a dropdown on the Jenkins user interface. Prior to version 4.27, access to this list was not restricted based on user permissions.

Recommendations Update to BlazeMeter Jenkins Plugin version 4.27 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13472

Affected Products

Blazemeter Jenkins Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13472 · Security Note
• https://reddit.com/r/VulnMatter/comments/1peus6e/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://twitter.com/CVEnew/status/1996147647527182775 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1peorgc/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1pe36tf/resumen_diario_de_vulnerabilidades_04122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1pevkbf/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://t.me/CVEtracker/38740 · Telegram Post
• https://t.me/cveNotify/144590 · Telegram Post
• https://portal.perforce.com/s/cve/a91Qi000002bFgTIAU/missing-authorization-in-blazemeter-jenkins-plugin · Note
• https://twitter.com/VulmonFeeds/status/1996165112151908673 · Twitter Post