CVE-2025-71258 is a CWE-918 SSRF vulnerability affecting BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001. The flaw exists in the searchWeb API component where improper URL validation allows authenticated attackers to cause the server to initiate arbitrary outbound requests. This blind SSRF can be used to scan internal networks or interact with internal services, which may affect system availability. BMC has released hotfixes for versions 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01 to address this vulnerability.

The vulnerability allows authenticated attackers to perform blind SSRF attacks, enabling them to make the vulnerable server send arbitrary outbound requests. This can be leveraged for internal network scanning or interacting with internal services, potentially impacting system availability. There is no indication of privilege escalation or data disclosure from the provided data.

BMC Software has released official hotfixes for multiple versions of FootPrints ITSM that remediate this SSRF vulnerability. Users should apply the appropriate hotfix for their version as listed: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01. Applying these hotfixes is the recommended remediation. Patch status is confirmed by vendor advisory information embedded in the description.