CVE-2024-3825 (published 2024-04-17T15:15Z)

Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Blazemeter/blazemeter-jenkins-plugin
commit_details: repo_url: https://github.com/Blazemeter/blazemeter-jenkins-plugin
author: mayukothule
author_date: 2024-04-17 14:26:12+05:30
msg: Fix for TT4016
repository: repo_url: https://github.com/Blazemeter/blazemeter-jenkins-plugin
repo_name: Blazemeter/blazemeter-jenkins-plugin
description: Run a BlazeMeter test as part of your Jenkins continuous integration process.
repo_language: Java
owner: Blazemeter
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+### v4.22 - 16-04-2024
+
+- `FIXED` - Fixed TT-4016
+
 ### v4.21 - 14-02-2024
 
 - `FIXED` - Fixed TT-3873 Tests are not getting fetched in the Jenkins BlazeMeter plugin

programming_language: Markdown
filename: pom.xml
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,7 @@
     <groupId>com.blazemeter.plugins</groupId>
     <artifactId>BlazeMeterJenkinsPlugin</artifactId>
     <packaging>hpi</packaging>
-    <version>4.21-SNAPSHOT</version>
+    <version>4.22-SNAPSHOT</version>
     <name>BlazeMeter plugin</name>
     <url>https://wiki.jenkins-ci.org/display/JENKINS/BlazeMeter+Plugin</url>
     <description>This is a plugin which allows a developer to run a set of performance tests against the BlazeMeter Cluster</description>
@@ -38,7 +38,7 @@
         <connection>scm:git:git@github.com:jenkinsci/blazemeter-plugin.git</connection>
         <developerConnection>scm:git:git@github.com:jenkinsci/blazemeter-plugin.git</developerConnection>
         <url>https://github.com/jenkinsci/blazemeter-plugin</url>
-        <tag> BlazeMeterJenkinsPlugin-4.20</tag>
+        <tag> BlazeMeterJenkinsPlugin-4.21</tag>
     </scm>
 
     <licenses>
@@ -93,6 +93,11 @@
             <artifactId>validation-api</artifactId>
             <version>1.0.0.GA</version>
         </dependency>
+        <dependency>
+            <groupId>org.kohsuke.stapler</groupId>
+            <artifactId>stapler</artifactId>
+            <version>1.263</version>
+        </dependency>
 
     </dependencies>
 

programming_language: HTML
filename: BlazeMeterPerformanceBuilderDescriptor.java
change_type: ModificationType.MODIFY
diff: @@ -54,6 +54,7 @@ import org.jenkinsci.Symbol;
 import org.kohsuke.stapler.QueryParameter;
 import org.kohsuke.stapler.Stapler;
 import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 @Symbol({"blazeMeterTest"})
 @Extension
@@ -131,6 +132,7 @@ public class BlazeMeterPerformanceBuilderDescriptor extends BuildStepDescriptor<
         }
     }
 
+    @RequirePOST
     public ListBoxModel doFillTestIdItems(@QueryParameter("credentialsId") String credentialsId,
                                           @QueryParameter("workspaceId") String workspaceId,
                                           @QueryParameter("testId") String testId) throws FormValidation {
@@ -237,6 +239,7 @@ public class BlazeMeterPerformanceBuilderDescriptor extends BuildStepDescriptor<
         return workspaces;
     }
 
+    @RequirePOST
     public ListBoxModel doFillWorkspaceIdItems(@QueryParameter("credentialsId") String credentialsId,
                                                @QueryParameter("workspaceId") String workspaceId) throws FormValidation {
         ListBoxModel items = new ListBoxModel();
@@ -290,7 +293,7 @@ public class BlazeMeterPerformanceBuilderDescriptor extends BuildStepDescriptor<
         return workspacesList;
     }
 
-
+    @RequirePOST
     public ListBoxModel doFillCredentialsIdItems(@QueryParameter("credentialsId") String credentialsId) {
         ListBoxModel items = new ListBoxModel();
         try {

programming_language: Java