CVE-2025-23215

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23215
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23215.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-23215
Aliases
Published
2025-01-31T15:25:53.026Z
Modified
2025-12-02T07:58:37.361688Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear CVSS Calculator
Summary
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
Details

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered potentially compromised. As a mitigation, both compromised keys have been revoked so that no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sourceforge.pmd are not compromised and the signatures are valid.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23215.json",
    "cwe_ids": [
        "CWE-200",
        "CWE-312",
        "CWE-540"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/pmd/pmd-designer

Affected ranges

Type
GIT
Repo
https://github.com/pmd/pmd-designer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
38f21f11f1c7cefaeed0d568fdd79d32d8cbed22

Affected versions

6.*
6.14.0
6.16.0
6.17.0
6.19.0
6.21.0
6.24.0
6.27.0
6.37.0
6.49.0
7.*
7.0.0
7.0.0-rc1
7.0.0-rc4
7.2.0
v6.*
v6.13.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23215.json"