Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Published: 2026-03-19
Score: 6.9 Medium
EPSS: 12.5% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from insufficient enforcement of security filters on restricted REST API endpoints and servlets, allowing unauthenticated remote attackers to bypass authentication and invoke privileged functions. This flaw permits attackers to read and modify application data and system resources, thereby compromising confidentiality, integrity, and availability. The weakness is identified as a CWE-306 (Authentication Bypass).

Affected Systems

BMC Software’s FootPrints ITSM, versions 20.20.02 through 20.24.01.001, are affected. The vendor has released hotfixes for these versions, which include 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Risk and Exploitability

The CVSS v3.1 score of 6.9 indicates Medium severity, while an EPSS score of 12% suggests a non‑negligible chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote; an attacker can send unauthenticated requests to protected REST endpoints to bypass access controls.

Generated by OpenCVE AI on May 17, 2026 at 15:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided hotfix that matches your FootPrints version, such as 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01.
  • If immediate patching is not possible, isolate FootPrints from external networks or configure firewall rules to block unauthenticated access to its REST API endpoints.
  • Periodically review application logs for unauthorized API requests and investigate any suspicious activity.

Generated by OpenCVE AI on May 17, 2026 at 15:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Bmc footprints Itsm
CPEs cpe:2.3:a:bmc:footprints_itsm:*:*:*:*:*:*:*:*
Vendors & Products Bmc footprints Itsm

Fri, 20 Mar 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Bmc
Bmc footprints
Vendors & Products Bmc
Bmc footprints

Thu, 19 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Title BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Authentication Bypass BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass

Thu, 19 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Mar 2026 14:00:00 +0000

Type Values Removed Values Added
Description BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Title BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Authentication Bypass
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Bmc Footprints Footprints Itsm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-14T02:08:58.859Z

Reserved: 2026-03-02T15:04:45.926Z

Link: CVE-2025-71257

cve-icon Vulnrichment

Updated: 2026-03-19T15:01:47.650Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-19T14:16:12.953

Modified: 2026-04-22T17:22:56.907

Link: CVE-2025-71257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-17T15:15:04Z

Weaknesses