CVE-2025-71257: BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.20.02 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.20.03.002 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.21.01.001 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.21.02.002 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.22.01 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.22.01.001 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.23.01 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.23.01.002 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.24.01
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71257?
CVE-2025-71257 is classified as a critical severity vulnerability due to the potential for unauthenticated remote attackers to exploit it.
How do I fix CVE-2025-71257?
To mitigate CVE-2025-71257, upgrade BMC FootPrints ITSM to a version later than 20.24.01.001 which addresses the authentication bypass issue.
What are the impacts of CVE-2025-71257?
CVE-2025-71257 allows unauthenticated access to restricted REST API endpoints and servlets, potentially leading to unauthorized data exposure.
Which versions of BMC FootPrints ITSM are affected by CVE-2025-71257?
CVE-2025-71257 affects BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001.
Is CVE-2025-71257 exploitable over the network?
Yes, CVE-2025-71257 is exploitable remotely, allowing attackers to bypass authentication from different locations.