Missing authorization in BlazeMeter Jenkins Plugin
Priority LOW 24CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix Fixed BlazeMeter (Perforce): 4.27com.blazemeter.plugins:BlazeMeterJenkinsPlugin (Maven): 4.27
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Perforce | BlazeMeter | before 4.27 | 4.27 | Patch available | CNA |
| — | com.blazemeter.plugins:BlazeMeterJenkinsPlugin (Maven) | before 4.27 | 4.27 | Patch available | GHSA-fxp5-37mh-vff5 |
- BlazeMeter VendorPerforce Affected before 4.27 Fixed in 4.27 Patch available CNA
- com.blazemeter.plugins:BlazeMeterJenkinsPlugin (Maven) Vendor— Affected before 4.27 Fixed in 4.27 Patch available GHSA-fxp5-37mh-vff5
Remediation
- Fix · CNA BlazeMeter (Perforce) Fixed in 4.27
- Fix · GHSA-fxp5-37mh-vff5 com.blazemeter.plugins:BlazeMeterJenkinsPlugin (Maven) Fixed in 4.27 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13472
- 2026-10-03 Alias added: GHSA-fxp5-37mh-vff5
References
More Perforce vulnerabilities
- TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
- TI-2026-71533 Perforce Helix Authentication Service ships a default SCIM token CVSS 4.0CRITICAL 9.3
- TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
- TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
- TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
- TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
Sources
- CVE-2025-13472 · CVE Program
- CVE-2025-13472 · NVD
- FIRST EPSS
- GHSA-fxp5-37mh-vff5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences