BMC FootPrints ITSM software versions 20.20.02 through 20.24.01.001 contain a blind server‑side request forgery vulnerability in the externalfeed/RSS API. The defect allows an authenticated attacker to trigger arbitrary outbound requests from the FootPrints server, enabling interaction with internal services or causing resource exhaustion that can impact availability. This weakness is identified as CWE‑918, i.e., Server‑Side Request Forgery.

Affected vendors and products are BMC Software, Inc.:FootPrints. All FootPrints ITSM releases from 20.20.02 up to 20.24.01.001 are vulnerable. The vendor has released hotfixes for the same series, including 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

The CVSS score is 5.3, indicating moderate severity. EPSS is not available and the vulnerability has not been cataloged in the CISA KEV list, suggesting a lower public exploitation probability. However, exploitation requires authenticated access to the system and can lead to internal network access or denial of service. The risk is significant for environments where FootPrints is exposed to users with the ability to invoke externalfeed/RSS, and the impact can extend to internal service availability.