What is GHSA-fxp5-37mh-vff5?

GHSA-fxp5-37mh-vff5 is a security advisory published by GitHub Security Advisories with Medium severity. BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources

Which CVE IDs does GHSA-fxp5-37mh-vff5 cover?

GHSA-fxp5-37mh-vff5 covers the following CVE IDs: CVE-2025-13472. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-fxp5-37mh-vff5?

GHSA-fxp5-37mh-vff5 affects 1 product, including: maven/com.blazemeter.plugins:BlazeMeterJenkinsPlugin:\u003c 4.27.

GHSA-fxp5-37mh-vff5Medium

BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources

Vendor

GitHub Security Advisories

Published

December 3, 2025

Last Modified

December 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-13472 →

📋 Description

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

🎯 Affected products1

maven/com.blazemeter.plugins:BlazeMeterJenkinsPlugin:< 4.27

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-13472
https://portal.perforce.com/s/cve/a91Qi000002bFgTIAU/missing-authorization-in-blazemeter-jenkins-plugin
https://github.com/jenkinsci/blazemeter-plugin/commit/9fe5ed70f063c18fd6b64bb4db3cbdb612f653d4
https://github.com/advisories/GHSA-fxp5-37mh-vff5