VYPR
Get started
← All advisories
Medium severityGHSA Advisory· Published Dec 3, 2025· Updated Apr 15, 2026

CVE-2025-13472

CVE-2025-13472

Description

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.blazemeter.plugins:BlazeMeterJenkinsPluginMaven
< 4.274.27

Affected products

1

Patches

1
9fe5ed70f063

Merge github.com:Blazemeter/blazemeter-jenkins-plugin

https://github.com/jenkinsci/blazemeter-pluginkothulemayurNov 26, 2025via ghsa
commit
3 files changed · +26 −3
  • CHANGELOG.md+4 −0 modified
    @@ -1,3 +1,7 @@
+### v4.27 - 26-11-2025
+
+- `FIXED` - Fixed MOB-44067
+
 ### v4.26 - 15-07-2025
 
 - `FIXED` - Fixed MOB-38674 - Jenkins build hangs for Blazemeter tests that take over an hour to execute
  • pom.xml+1 −1 modified
    @@ -15,7 +15,7 @@
     <groupId>com.blazemeter.plugins</groupId>
     <artifactId>BlazeMeterJenkinsPlugin</artifactId>
     <packaging>hpi</packaging>
-    <version>4.27-SNAPSHOT</version>
+    <version>4.28-SNAPSHOT</version>
     <name>BlazeMeter plugin</name>
     <url>https://wiki.jenkins-ci.org/display/JENKINS/BlazeMeter+Plugin</url>
     <description>This is a plugin which allows a developer to run a set of performance tests against the BlazeMeter Cluster</description>
  • src/main/java/hudson/plugins/blazemeter/BlazeMeterPerformanceBuilderDescriptor.java+21 −2 modified
    @@ -137,6 +137,12 @@ public ListBoxModel doFillTestIdItems(@QueryParameter("credentialsId") String cr
                                           @QueryParameter("workspaceId") String workspaceId,
                                           @QueryParameter("testId") String testId) throws FormValidation {
 
+        Item item = Stapler.getCurrentRequest().findAncestorObject(Item.class);
+        if (item != null) {
+            item.checkPermission(Item.READ);
+        } else {
+            Jenkins.get().checkPermission(Jenkins.READ);
+        }
         ListBoxModel items = new ListBoxModel();
 
         try {
@@ -242,6 +248,13 @@ private List<Workspace> getWorkspaces(BlazeMeterUtils utils) throws IOException
     @RequirePOST
     public ListBoxModel doFillWorkspaceIdItems(@QueryParameter("credentialsId") String credentialsId,
                                                @QueryParameter("workspaceId") String workspaceId) throws FormValidation {
+        Item item = Stapler.getCurrentRequest().findAncestorObject(Item.class);
+        if (item != null) {
+            item.checkPermission(Item.READ);
+        } else {
+            Jenkins.get().checkPermission(Jenkins.READ);
+        }
+
         ListBoxModel items = new ListBoxModel();
 
         try {
@@ -295,10 +308,16 @@ private ListBoxModel workspacesList(BlazeMeterUtils utils, String savedWorkspace
 
     @RequirePOST
     public ListBoxModel doFillCredentialsIdItems(@QueryParameter("credentialsId") String credentialsId) {
+
+        Item item = Stapler.getCurrentRequest().findAncestorObject(Item.class);
+        if (item != null) {
+            item.checkPermission(Item.CONFIGURE);
+        } else {
+            Jenkins.get().checkPermission(Jenkins.ADMINISTER);
+        }
+
         ListBoxModel items = new ListBoxModel();
         try {
-
-            Item item = Stapler.getCurrentRequest().findAncestorObject(Item.class);
             List<BlazemeterCredentialsBAImpl> credentials =
                     CredentialsProvider.lookupCredentials(
                             BlazemeterCredentialsBAImpl.class,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.