CVE-2025-71259

MEDIUMNuclei

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-71259 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

FootPrints

Browse BMC Software, Inc. / FootPrints

Default status: unaffected

CVE List20.20.02 to ≤ 20.24.01.001affected

Nuclei templates

1
ProjectDiscoveryHIGHBMC FootPrints 'feedUrl' - Server-Side Request ForgeryCVSS 8.6

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery (SSRF) vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling access to internal services and bypassing firewall restrictions. This vulnerability is part of a pre-authenticated RCE chain when combined with CVE-2025-71257 (auth bypass) and CVE-2025-71260 (deserialization).

Impact

Authenticated attackers can make the server send arbitrary outbound requests, potentially interacting with internal services or causing denial of service.

Remediation

Apply the hotfixes released by BMC on September 2, 2025 for all affected branches. Update to the latest patched version of BMC FootPrints.

WeaknessesCWE-918
AuthorswatchTowr, DhiyaneshDk
Template tagscvecve2025servicedeskbmc-softwaressrfoastoobfootprintsbmc
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Shodan: html:"/footprints/servicedesk/"
FOFA: body="/footprints/servicedesk/"
https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/ https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/ https://nvd.nist.gov/vuln/detail/CVE-2025-71259

Source: ProjectDiscovery

References

4