CVE-2025-13472
NoneCVSS
—
EPSS
0.2%
Published
Dec 3, 2025
CISA due date
—
The record
A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.blazemeter.plugins:BlazeMeterJenkinsPlugin | 0 | 4.27 |
Related vulnerabilities
- GHSA-fxp5-37mh-vff5 BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources Same vulnerability
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862
- CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful… CWE-862
- CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful… CWE-862
- CVE-2026-87943 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful… CWE-862
- CVE-2026-84916 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. CWE-862