TI-2025-43384 Aliases CVE-2025-71259 GHSA-787q-47vg-6mqr

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

MEDIUM 57CWE-918Published 2026-03-19 · Updated 2026-08-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.12916 96th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BMC Software, Inc.	FootPrints	20.20.02 – 20.24.01.001	—	No fix listed	CNA

FootPrints VendorBMC Software, Inc. Affected 20.20.02 – 20.24.01.001 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:bmc:footprints::::::::	20.20.02 – 20.24.01.001	Vulnerable	BMC

cpe:2.3:a:bmc:footprints:*:*:*:*:*:*:*:* Versions 20.20.02 – 20.24.01.001 Vulnerable ·BMC

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-71259
2026-10-03 Alias added: GHSA-787q-47vg-6mqr

References

Exploit 1

https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/

Patch 1

https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/

TI-2024-38395 Compuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload CVSS 4.0CRITICAL 9.2
TI-2025-43385 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE CVSS 4.0HIGH 8.7
TI-2025-43382 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass CVSS 4.0MEDIUM 6.9
TI-2025-43383 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb CVSS 4.0MEDIUM 5.3
TI-2019-13850 BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2). CVSS 3.1HIGH 8.8
TI-2019-13847 BMC Control-M/Agent 7.0.00.000 allows OS Command Injection. CVSS 3.1HIGH 8.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences