CVE-2025-71257
Authentication Bypass in BMC FootPrints ITSM REST API
Publication date: 2026-03-19
Last updated on: 2026-04-22
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bmc | footprints_itsm | From 20.20.02 (inc) to 20.24.01.001 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-71257 is an authentication bypass vulnerability in BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001. It occurs because security filters on restricted REST API endpoints and servlets are not properly enforced.
This flaw allows unauthenticated remote attackers to bypass access controls, enabling them to invoke restricted functions, gain unauthorized access to application data, and modify system resources.
The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS v4 base score of 6.9, indicating it can be exploited over the network with low complexity and no privileges or user interaction required.
How can this vulnerability impact me? :
This vulnerability can have significant impacts as it allows attackers to bypass authentication and access restricted functionality without any credentials.
- Unauthorized access to sensitive application data.
- Ability to modify system resources, potentially disrupting normal operations.
- Increased risk of data breaches and system compromise due to lack of proper access controls.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the authentication bypass vulnerability in BMC FootPrints ITSM, you should apply the appropriate hotfixes provided by BMC for your version.
- Install the hotfix for your version if it is one of the affected versions: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01.001.
- Ensure that your system is updated to a version that includes these hotfixes to properly enforce security filters on restricted REST API endpoints and servlets.