Overview
CVE-2025-13472 identifies a missing authorization vulnerability in the BlazeMeter Jenkins Plugin. Specifically, version 4.27 addressed an issue where all users, regardless of their assigned permissions within Jenkins, could view sensitive resource information. This information includes credential IDs, BlazeMeter workspace details, and BlazeMeter project IDs via a dropdown menu in the Jenkins UI.
Prior to the fix implemented in version 4.27, this information disclosure could potentially be exploited by unauthorized users to gain access to sensitive BlazeMeter resources, leading to unintended consequences.
Technical Details
The vulnerability stemmed from a lack of proper authorization checks when displaying resource options within the BlazeMeter Jenkins Plugin’s user interface. The dropdown lists for selecting credentials, workspaces, and project IDs were accessible without verifying if the current user had the necessary permissions to view or utilize those resources. This allowed any authenticated Jenkins user, even those with limited privileges, to enumerate these sensitive identifiers.
The fix implemented in version 4.27 introduces authorization checks to ensure that only users with appropriate permissions can access and view the dropdown options containing credential IDs, BlazeMeter workspace details and BlazeMeter project IDs.
CVSS Analysis
Currently, a CVSS score has not been assigned to CVE-2025-13472. The severity is listed as N/A. However, given the nature of the information disclosure (credential IDs, workspace and project identifiers), it’s crucial to address this vulnerability promptly. While direct access to resources might not be granted by simply viewing these IDs, it significantly reduces the attack surface for more sophisticated attacks and could aid in reconnaissance efforts.
Possible Impact
While the vulnerability itself doesn’t directly grant unauthorized access, the information disclosed can have several potential impacts:
- Reconnaissance: Attackers can gather information about the BlazeMeter infrastructure and available resources.
- Credential Compromise: Exposure of credential IDs can be a stepping stone for attackers to attempt brute-forcing or other credential-based attacks.
- Lateral Movement: Gaining insight into workspace and project IDs can assist in lateral movement within the BlazeMeter environment.
- Data Exposure: Depending on the permissions associated with the compromised credentials, sensitive data might be accessed.
Mitigation or Patch Steps
The primary mitigation step is to upgrade the BlazeMeter Jenkins Plugin to version 4.27 or later. This version contains the fix that addresses the missing authorization vulnerability.
- Navigate to the Jenkins plugin management page (typically found under Manage Jenkins -> Manage Plugins).
- Search for “BlazeMeter” plugin.
- If your current version is older than 4.27, update the plugin to the latest available version.
- Restart Jenkins after the update to ensure the changes are applied correctly.
