Maven/net.sourceforge.pmd:pmd-ui CVE-2025-23215: critical, EPSS 0.33%

PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-88m4-h43f-wx84#Maven/net.sourceforge.pmd:pmd-ui
• https://github.com/pmd/pmd/security/advisories/GHSA-88m4-h43f-wx84
• https://nvd.nist.gov/vuln/detail/CVE-2025-23215
• https://github.com/pmd/pmd-designer/commit/1548f5f27ba2981b890827fecbd0612fa70a0362
• https://github.com/pmd/pmd-designer/commit/e87a45312753ec46b3e5576c6f6ac1f7de2f5891
• https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/net/sourceforge/pmd/pmd-designer/README.md
• https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/net/sourceforge/pmd/pmd-designer/pmd-designer-7.0.0.diffoscope
• https://github.com/jvm-repo-rebuild/reproducible-central?tab=readme-ov-file#reproducible-builds-for-maven-central-repository
• https://github.com/pmd/pmd

CVE-2025-23215 · published 2025-01-31T17:34:09Z · modified 2025-04-04T21:21:27.362409Z · JSON