CVE-2025-71259

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

Published Mar 19, 2026 CVSS 4.0 · 5.3 Medium EPSS 12.5% KEV · Not listed

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Analysis

Technical impact

BMC FootPrints ITSM software versions 20.20.02 through 20.24.01.001 contain a blind server‑side request forgery vulnerability in the externalfeed/RSS API. The defect allows an authenticated attacker to trigger arbitrary outbound requests from the FootPrints server, enabling interaction with internal services or causing resource exhaustion that can impact availability. This weakness is identified as CWE‑918, i.e., Server‑Side Request Forgery.

Affected Systems

Affected vendors and products are BMC Software, Inc.:FootPrints. All FootPrints ITSM releases from 20.20.02 up to 20.24.01.001 are vulnerable. The vendor has released hotfixes for the same series, including 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity. EPSS is 13% and the vulnerability has not been catalogued in the CISA KEV list, indicating a moderate public exploitation probability. However, exploitation requires authenticated access to the system and can lead to internal network access or denial of service. The risk is significant for environments where FootPrints is exposed to users with the ability to invoke externalfeed/RSS, and the impact can extend to internal service availability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

BMC Software, Inc.

FootPrints

unaffected

Version	Status	Constraints
`20.20.02`	affected	≤ 20.24.01.001

Configuration 1 [-]

cpe:2.3:a:bmc:footprints:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Bmc

Footprints

Version	Status	Scheme	Platform
`[20.20.02,20.24.01.001]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor‑provided hotfix corresponding to your FootPrints ITSM version (e.g., 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01).
If a patch is not immediately available, disable the externalfeed/RSS functionality or restrict its use to trusted users to prevent the blind SSRF from being triggered.
Verify network segmentation to ensure FootPrints servers cannot reach critical internal services, mitigating potential internal disclosure or denial of service.

Generated by OpenCVE AI on June 18, 2026 at 04:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 12.5% (12.492% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/
https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
https://www.vulncheck.com/advisories/bmc-footprints-itsm-blind-ssrf-in-externalfeed-rss

History

Apr 22, 2026 5:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Bmc footprints Itsm
CPEs		cpe:2.3:a:bmc:footprints_itsm::::::::
Vendors & Products		Bmc footprints Itsm

Mar 20, 2026 9:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Bmc Bmc footprints
Vendors & Products		Bmc Bmc footprints

Mar 19, 2026 5:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Blind SSRF in externalfeed/RSS	BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

Mar 19, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 19, 2026 2:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Title		BMC 20.20.02 <= 20.24.01.001 FootPrints ITSM Blind SSRF in externalfeed/RSS
Weaknesses		CWE-918
References		https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/ https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/ https://www.vulncheck.com/advisories/bmc-footprints-itsm-blind-ssrf-in-externalfeed-rss
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`