CVE-2025-71259

CVE Enrichment

CVSS: 5.3 MEDIUM
EPSS: 12.92%
EPSS Percentile: 96.33%
CISA KEV: Not listed

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 19-Mar-2026 21:16
Last Modified: 06-Aug-2026 22:21
EPSS Date: 2026-11-07
CWE: CWE-918

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:N /
                            VI:N /
                            VA:L /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

BMC Software, Inc. · FootPrints Source: CNA · [email protected]
Default status: unaffected

20.20.02 ≤ version ≤ 20.24.01.001 — affected (custom)

Affected Products / Versions

bmc / footprints Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.20.02 · through (inclusive) 20.24.01.001
cpe:2.3:a:bmc:footprints:*:*:*:*:*:*:*:*

References

Last enrichment sync: 08-Nov-2026 17:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Four security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote code ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploitation and MCP Abuse

CVE (6)

Malware (5)

People (1)

Threat Actors (6)

MITRE ATT&CK (7)

Vendors (3)

Products (10)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.