Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Published: 2026-03-19
Score: 6.9 Medium
EPSS: 7.7% Low
KEV: No
Impact: Unauthorized Access to data and system resources
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows unauthenticated remote attackers to bypass authentication and gain unauthorized access to application data and system resources. The attacker can exploit the lack of proper security filter enforcement on restricted REST API endpoints and servlets. This is a CWE‑306 (Authentication Bypass) weakness that exposes sensitive data and allows modification of system resources.

Affected Systems

FootPrints ITSM from BMC Software, Inc. versions 20.20.02 through 20.24.01.001

Risk and Exploitability

The CVSS v3.1 score is 6.9 indicating medium severity. EPSS score is not available and it is not listed in the KEV catalog. The vulnerability is exploitable remotely by unauthenticated attackers who can issue requests to restricted REST endpoints. The attack path does not require user interaction and could allow full control over data within the application.

Generated by OpenCVE AI on March 19, 2026 at 15:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor-provided hotfix for your FootPrints version (e.g., 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01).
  • If patching cannot be performed immediately, isolate FootPrints from external networks or restrict access to its REST API endpoints to prevent unauthenticated access.
  • Monitor FootPrints application logs for suspicious or unauthorized API access attempts.

Generated by OpenCVE AI on March 19, 2026 at 15:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Bmc footprints Itsm
CPEs cpe:2.3:a:bmc:footprints_itsm:*:*:*:*:*:*:*:*
Vendors & Products Bmc footprints Itsm

Fri, 20 Mar 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Bmc
Bmc footprints
Vendors & Products Bmc
Bmc footprints

Thu, 19 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Title BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Authentication Bypass BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass

Thu, 19 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Mar 2026 14:00:00 +0000

Type Values Removed Values Added
Description BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Title BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Authentication Bypass
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Bmc Footprints Footprints Itsm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-19T16:48:09.794Z

Reserved: 2026-03-02T15:04:45.926Z

Link: CVE-2025-71257

cve-icon Vulnrichment

Updated: 2026-03-19T15:01:47.650Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-19T14:16:12.953

Modified: 2026-04-22T17:22:56.907

Link: CVE-2025-71257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T14:15:02Z

Weaknesses