Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-23215— PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

Quick assessment

Affected
pmd pmd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PMD是一种可扩展的多语言静态源代码分析器。 PMD存在安全漏洞，该漏洞源于发布签名密钥的密码可能被泄露。

EPSS 0.32% · P25

Possible ATT&CK Techniques 1 AI

T1588.002 · Tool
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-23215

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
Source: CVE Program / CVE List V5
Vulnerability Description
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered potentially compromised. As a mitigation, both compromised keys have been revoked so that no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sourceforge.pmd are not compromised and the signatures are valid.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
PMD 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PMD是一种可扩展的多语言静态源代码分析器。 PMD存在安全漏洞，该漏洞源于发布签名密钥的密码可能被泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
pmd pmd < 7.10.0 -

II. Public POCs for CVE-2025-23215

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-23215

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-23215 (2)

Vendor Advisories for CVE-2025-23215 (1)

IV. Related Vulnerabilities

Same product: pmd
Same vendor: pmd
Same weakness: CWE-200

V. Comments for CVE-2025-23215

No comments yet

Leave a comment