CVE-2025-71260highCWE-502

CVE-2025-71260: fallo de gravedad alta en BMC Software, Inc. FootPrints

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE

Publicada el · Actualizada el

33Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 34%
probabilidad de explotación
34%top 2% de las CVE
explotación observada
noninguna fuente lo reporta
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
BMC Software, Inc. · FootPrints
CVEs relacionadas — BMC Software, Inc. FootPrints

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-71257MEDIUMBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication BypassEPSS 44.6%CVE-2025-71258MEDIUMBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWebEPSS 17.4%CVE-2025-71259MEDIUMBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSSEPSS 12.9%
Referencias
https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/https://www.vulncheck.com/advisories/bmc-footprints-itsm-viewstate-deserialization-rce