CVE-2025-71259 is a CWE-918 SSRF vulnerability affecting BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001. The vulnerability exists in the externalfeed/RSS API component, where insufficient validation of externally supplied resource references allows authenticated attackers to trigger arbitrary outbound requests from the server. This can be leveraged to interact with internal services or cause resource exhaustion, impacting service availability. Hotfixes addressing this issue include versions 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

The vulnerability allows authenticated attackers to cause the server to make arbitrary outbound requests, which can be used to access internal services not normally reachable externally or to exhaust server resources, potentially leading to denial of service conditions. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the moderate impact and the requirement for authentication.

Apply the vendor-provided hotfixes to remediate this vulnerability. The fixed versions include 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01. Users running affected versions should upgrade to one of these patched versions to mitigate the risk. No additional vendor advisories indicate alternative mitigations or that no action is required.