Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Published: 2026-03-19
Score: 5.3 Medium
EPSS: 2.3% Low
KEV: No
Impact: Blind SSRF enabling internal resource access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a blind server‑side request forgery in the FootPrints ITSM searchWeb API. Authenticated attackers can supply arbitrary URLs that the server will resolve and request, using the FootPrints instance’s outbound network connectivity. This allows internal network scanning or interaction with internal services and can impact system availability. The weakness is classified as CWE‑918.

Affected Systems

Affected vendors and products are BMC Software, Inc. FootPrints ITSM. Versions from 20.20.02 up to and including 20.24.01.001 contain the flaw. BMC has released hot‑fixes for this issue; the following patched releases remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Risk and Exploitability

The CVSS v3 score is 5.3, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to submit a request to the searchWeb API, after which the server will perform an outbound request. The likelihood of exploitation is therefore limited to users with legitimate credentials who can reach the vulnerable API endpoint.

Generated by OpenCVE AI on March 19, 2026 at 15:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FootPrints ITSM to any of the patched releases: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01.

Generated by OpenCVE AI on March 19, 2026 at 15:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Bmc footprints Itsm
CPEs cpe:2.3:a:bmc:footprints_itsm:*:*:*:*:*:*:*:*
Vendors & Products Bmc footprints Itsm

Fri, 20 Mar 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Bmc
Bmc footprints
Vendors & Products Bmc
Bmc footprints

Thu, 19 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Title BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Blind SSRF in searchWeb BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb

Thu, 19 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Mar 2026 14:00:00 +0000

Type Values Removed Values Added
Description BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Title BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Blind SSRF in searchWeb
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Bmc Footprints Footprints Itsm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-19T16:48:25.667Z

Reserved: 2026-03-02T15:04:45.927Z

Link: CVE-2025-71258

cve-icon Vulnrichment

Updated: 2026-03-19T15:01:23.914Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-19T14:16:13.180

Modified: 2026-04-22T17:25:06.440

Link: CVE-2025-71258

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T14:15:00Z

Weaknesses