CVE-2025-71258

CVE Enrichment

CVSS: 5.3 MEDIUM
EPSS: 17.43%
EPSS Percentile: 97.14%
CISA KEV: Not listed

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 19-Mar-2026 21:16
Last Modified: 06-Aug-2026 22:21
EPSS Date: 2026-11-07
CWE: CWE-918

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:N /
                            VI:N /
                            VA:L /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

BMC Software, Inc. · FootPrints Source: CNA · [email protected]
Default status: unaffected

20.20.02 ≤ version ≤ 20.24.01.001 — affected (custom)

Affected Products / Versions

bmc / footprints Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.20.02 · through (inclusive) 20.24.01.001
cpe:2.3:a:bmc:footprints:*:*:*:*:*:*:*:*

References

Last enrichment sync: 08-Nov-2026 17:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Four security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote code ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploitation and MCP Abuse

CVE (6)

Malware (5)

People (1)

Threat Actors (6)

MITRE ATT&CK (7)

Vendors (3)

Products (10)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.