CVE-2025-71259: BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.20.02 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.20.03.002 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.21.01.001 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.21.02.002 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.22.01 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.22.01.001 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.23.01 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.23.01.002 - Upgrade
Upgrade
BMC FootPrints ITSM externalfeed/RSSto a version that resolves this vulnerability.Fixed in 20.24.01
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71259?
CVE-2025-71259 is classified as a critical vulnerability due to the potential for authenticated attackers to exploit the blind SSRF to trigger arbitrary outbound requests.
How do I fix CVE-2025-71259?
To fix CVE-2025-71259, update BMC FootPrints ITSM to a version greater than 20.24.01.001 to mitigate the vulnerability.
What software is affected by CVE-2025-71259?
CVE-2025-71259 affects BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001.
What does blind SSRF mean in the context of CVE-2025-71259?
In the context of CVE-2025-71259, blind SSRF refers to a type of server-side request forgery where an attacker can send requests without being able to see the response, potentially accessing internal resources.
Who can exploit CVE-2025-71259?
CVE-2025-71259 can be exploited by authenticated users who have access to the externalfeed/RSS API component of BMC FootPrints ITSM.