CVE-2025-71258

Katalog CVE

CVSS 7.1 · High EPSS 17,4%

Kerentanan Server-Side Request Forgery (SSRF) pada bmc footprints. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

17,4% peluang dieksploitasi; lebih tinggi dari 97,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-P... patch
• https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-rem... exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/bmc-footprints-itsm-blind-ssrf-in-searchweb advisory pihak ketiga