BlazeMeter Jenkins Plugin Missing Authorization Vulnerability

A missing authorization vulnerability exists in BlazeMeter Jenkins Plugin versions prior to 4.27, allowing users without the necessary permissions to access a dropdown list of available resources in the Jenkins UI. This list included credential IDs, BlazeMeter workspaces, and project IDs. The issue has been addressed in version 4.27, which restricts access to users with specific permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized users gaining access to sensitive resource information, such as credential IDs and project-related data, which could be misused in the Jenkins environment.

Remediation

Users can update to BlazeMeter Jenkins Plugin version 4.27 or later to address this vulnerability.