CVE-2025-71259mediumCWE-918

CVE-2025-71259: medium-severity vulnerability in BMC Software, Inc. FootPrints

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

Published · Updated

33Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 5.3epss 13%
exploitation probability
13%top 4% of all CVEs
observed exploitation
nono source reports it
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
BMC Software, Inc. · FootPrints
Related CVEs — BMC Software, Inc. FootPrints

In the same product, most dangerous first.

CVE-2025-71257MEDIUMBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication BypassEPSS 44.6%CVE-2025-71260HIGHBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCEEPSS 34.4%CVE-2025-71258MEDIUMBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWebEPSS 17.4%
References
https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/https://www.vulncheck.com/advisories/bmc-footprints-itsm-blind-ssrf-in-externalfeed-rss