Is net.sourceforge.pmd:pmd-designer affected by CVE-2025-23215?

Maven net.sourceforge.pmd:pmd-designer is affected in >=7.0.0 <7.10.0.

Is CVE-2025-23215 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

critical

CVE-2025-23215

Q: Is CVE-2025-23215 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Maven · net.sourceforge.pmd:pmd-designer • Maven · net.sourceforge.pmd:pmd-ui • Maven · net.sourceforge.pmd:pmd-core

Summary

PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

Severity: critical
EPSS: 0.3% (p22)
Also known as: GHSA-88m4-h43f-wx84#net.sourceforge.pmd:pmd-core, GHSA-88m4-h43f-wx84#net.sourceforge.pmd:pmd-designer, GHSA-88m4-h43f-wx84#net.sourceforge.pmd:pmd-ui
Published: 2025-01-31

References

https://github.com/pmd/pmd/security/advisories/GHSA-88m4-h43f-wx84
https://nvd.nist.gov/vuln/detail/CVE-2025-23215
https://github.com/pmd/pmd-designer/commit/1548f5f27ba2981b890827fecbd0612fa70a0362

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.