Missing permission check in BlazeMeterJenkinsPlugin allows enumerating credentials IDs

BlazeMeterJenkinsPlugin 4.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

CVE-2025-13472

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI...

CVE-2025-13472

CVE-2025-13472 concerns the BlazeMeter Jenkins Plugin. The Red Hat and NVD entries, plus multiple security advisories, confirm that versions prior to 4.27 expose a list of sensitive resources (credential IDs, BlazeMeter workspaces, and project IDs) to users who should not have access. The underly...

CVE-2025-13472 Missing authorization in BlazeMeter Jenkins Plugin

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI...

CVE-2025-13472: Missing Authorization

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI...

PT-2025-48800

Name of the Vulnerable Software and Affected Versions BlazeMeter Jenkins Plugin versions prior to 4.27 Description A flaw existed in the BlazeMeter Jenkins Plugin that allowed unauthorized users to view a list of available resources, including credential IDs, bzm workspaces, and bzm project IDs,...

EUVD-2024-1289

Malicious code in bioql PyPI...

CVE-2024-3825

Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration...

CVE-2024-3825

Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration...

CVE-2024-3825 CSRF in BlazeMeter Jenkins plugin

Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration...

CVE-2024-3825

CVE-2024-3825 affects the BlazeMeter Jenkins plugin prior to version 4.22. The issue is a cross‑site request forgery (CSRF) that can lead to credential enumeration. Impact is limited to the described vulnerability; exploitation status is not detailed in the provided documents. Remediation: upgrad...

CVE-2024-3825: Cross-Site Request Forgery (CSRF)

Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration...

BlazeMeter Jenkins plugin 安全漏洞

BlazeMeter Jenkins plugin is an open source plugin for BlazeMeter. It is used to run performance tests on a load testing platform. A security vulnerability exists in BlazeMeter Jenkins plugin versions prior to 4.22 that stems from the presence of a cross-site request forgery CSRF vulnerability...