CVE-2025-71257
Received Received - Intake
Authentication Bypass in BMC FootPrints ITSM REST API

Publication date: 2026-03-19

Last updated on: 2026-04-22

Assigner: VulnCheck

Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-19
Last Modified
2026-04-22
Generated
2026-06-16
AI Q&A
2026-03-19
EPSS Evaluated
2026-06-15
NVD
CVE-2025-71257
EUVD
EUVD-2025-208871
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bmc footprints_itsm From 20.20.02 (inc) to 20.24.01.001 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-71257 is an authentication bypass vulnerability in BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001. It occurs because security filters on restricted REST API endpoints and servlets are not properly enforced.

This flaw allows unauthenticated remote attackers to bypass access controls, enabling them to invoke restricted functions, gain unauthorized access to application data, and modify system resources.

The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS v4 base score of 6.9, indicating it can be exploited over the network with low complexity and no privileges or user interaction required.

Impact Analysis

This vulnerability can have significant impacts as it allows attackers to bypass authentication and access restricted functionality without any credentials.

  • Unauthorized access to sensitive application data.
  • Ability to modify system resources, potentially disrupting normal operations.
  • Increased risk of data breaches and system compromise due to lack of proper access controls.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the authentication bypass vulnerability in BMC FootPrints ITSM, you should apply the appropriate hotfixes provided by BMC for your version.

  • Install the hotfix for your version if it is one of the affected versions: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01.001.
  • Ensure that your system is updated to a version that includes these hotfixes to properly enforce security filters on restricted REST API endpoints and servlets.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart