CVE-2025-71258

MEDIUMNuclei

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-71258 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

FootPrints

Browse BMC Software, Inc. / FootPrints

Default status: unaffected

CVE List20.20.02 to ≤ 20.24.01.001affected

Nuclei templates

1
ProjectDiscoveryHIGHBMC FootPrints 'searchWeb' - Server-Side Request ForgeryCVSS 8.6

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery (SSRF) vulnerability in the /footprints/servicedesk/import/searchWeb endpoint. The 'url' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling access to internal services and bypassing firewall restrictions. This vulnerability is part of a pre-authenticated RCE chain when combined with CVE-2025-71257 (auth bypass) and CVE-2025-71260 (deserialization).

Impact

Authenticated attackers can cause the server to make arbitrary outbound requests, potentially impacting system availability and internal network security.

Remediation

Apply the hotfixes released by BMC on September 2, 2025 for all affected branches. Update to the latest patched version of BMC FootPrints.

WeaknessesCWE-918
AuthorswatchTowr, DhiyaneshDk
Template tagscvecve2025servicedeskbmc-softwaressrfoastoobfootprintsbmc
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Shodan: html:"BMC Software"
FOFA: body="/footprints/servicedesk/"
https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/ https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/

Source: ProjectDiscovery

References

4