Login Request a demo
Medium severity · published Dec 3, 2025
CVE-2025-13472
Missing authorization in BlazeMeter Jenkins Plugin
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
BlazeMeter · Perforce
before 4.27 · source: vendor
Affected product
BL
BlazeMeter
Perforce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13472
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13472
portal.perforce.com
https://portal.perforce.com/s/cve/a91Qi000002bFgTIAU/missing-authorization-in-blazemeter-jenkins-plugin