LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71257: BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

HighCVSS 7.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

BMC FootPrints ITSM has a pre-authentication flaw that can let outsiders use restricted functions without logging in. Reported impact includes reading application data and changing system resources. For organizations using FootPrints for IT service workflows, this could expose ticketing data and disrupt operations. BMC lists hotfixes for affected release lines.

Executive priority

Prioritize remediation promptly where FootPrints is reachable from untrusted networks or stores sensitive ticket data. The issue is high severity because attackers need no account or user interaction, and the application may hold operational, identity, and support information.

Technical view

CVE-2025-71257 is CWE-306: missing authentication for restricted REST API endpoints and servlets. The CVSS 3.1 score is 7.3 with network access, low complexity, no privileges, and no user interaction required. Confidentiality, integrity, and availability impacts are each rated low in the provided vector.

Likely exposure

Exposure applies to BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001. Internet-facing deployments carry the highest concern, but internal deployments may still be exposed to unauthenticated network attackers who can reach the application.

Exploitation context

The source bundle includes public technical research and a third-party advisory. It does not show CISA KEV listing or confirmed active exploitation. Treat exploitability as credible because the flaw is unauthenticated and remotely reachable, but do not claim in-the-wild exploitation from these sources alone.

Researcher notes

Evidence supports an authentication bypass caused by improper security filter enforcement on restricted REST endpoints and servlets. Public sources mention exploit research, but this response avoids offensive detail. Source coverage is sufficient for exposure triage, though operational indicators and active exploitation evidence are incomplete.

Mitigation direction

  • Identify all BMC FootPrints ITSM instances and versions.
  • Apply the relevant BMC hotfix for the affected release line.
  • Restrict network access to FootPrints until remediation is complete.
  • Review vendor guidance for any additional hardening or configuration steps.
  • Monitor logs for unauthenticated access to restricted REST endpoints and servlets.

Validation and detection

  • Confirm deployed FootPrints version is outside the affected range or hotfixed.
  • Review BMC release notes for the exact hotfix matching your branch.
  • Verify restricted API and servlet paths require authentication.
  • Check access logs for suspicious unauthenticated requests before patching.
  • Document remediation evidence for vulnerability management tracking.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-306: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-71257 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.3CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L3.93.4VulnCheck
6.9CVSS 4.0MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N——VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

6.9Medium
CVSS 4.0 vector shape for CVE-2025-71257Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
BMC Software, Inc.FootPrints20.20.02unaffected
Weakness

CWE details

CWE-306

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-306 · source CWE mapping

Missing Authentication for Critical Function

Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs