CVE-2025-13472CWE-862broken-access-control

CVE-2025-13472

published December 3, 2025

CVSS
5.3
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-03T14:15Z
References (1)
https://portal.perforce.com/s/cve/a91Qi000002bFgTIAU/missing-authorization-in-blazemeter-jenkins-plugin · [email protected]
EPSS history
Timeline
  • 03 DEC 08:42Z
    Missing authorization in BlazeMeter Jenkins Plugin
    cvelistv5