Listen to this Post
This vulnerability exists in the BlazeMeter Jenkins Plugin. The plugin provides configuration options in the Jenkins UI, such as dropdown menus, to select resources like credential IDs, BlazeMeter workspaces, and project IDs. These resources are fetched dynamically by the plugin’s backend code to populate the UI elements. The security flaw occurred because the plugin endpoints responsible for providing the list of these available resources did not perform any authorization checks. Any user with access to the Jenkins instance, including unauthenticated users if Jenkins is publicly exposed, could send a direct HTTP request to these endpoints. For example, a request to `/jenkins/plugin/blazemeter-/descriptor/…/fillItems` would return the sensitive list of IDs without verifying if the requesting user has the necessary permissions (like Item/READ or Credentials/VIEW) to see them. This information disclosure could aid an attacker in launching further targeted attacks by enumerating valid resource identifiers.
DailyCVE Form:
Platform: Jenkins BlazeMeter Plugin
Version: < 4.27
Vulnerability: Missing Authorization
Severity: Moderate
Date: 2025-12-03
Prediction: Patched 2025-12-03
What Undercode Say:
`curl -k “https://jenkins-server/plugin/blazemeter-/descriptorByUrl/fillItems?value=credentials”`
`grep -r “fillItems” $JENKINS_HOME/plugins/blazemeter.jpi`
`find / -name “blazemeter.jpi” 2>/dev/null`
How Exploit:
Direct endpoint request.
Enumeration via UI.
Unauthenticated access possible.
Protection from this CVE
Update to v4.27.
Restrict Jenkins access.
Apply principle of least privilege.
Impact:
Unauthorized information disclosure.
Credential ID exposure.
Attack surface increase.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
