PT-2025-4854 · Pmd · Pmd

Hboutemy · Published 2025-01-31 · Updated 2025-01-31 · CVE-2025-23215

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear

Name of the Vulnerable Software and Affected Versions PMD (affected versions not specified)

Description PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in a jar published to Maven Central. Although the private key itself is not known to have been compromised, its potential compromise must be considered due to the exposed passphrase. As a mitigation, both compromised keys have been revoked to prevent future use.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-312

CWE-540

Related Identifiers

CVE-2025-23215

GHSA-88M4-H43F-WX84

Affected Products

Pmd

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23215.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-23215 · Security Note
• https://osv.dev/vulnerability/GHSA-88m4-h43f-wx84 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23215 · Vendor Advisory
• https://github.com/pmd/pmd · Note
• https://github.com/pmd/pmd/security/advisories/GHSA-88m4-h43f-wx84 · Note
• https://github.com/jvm-repo-rebuild/reproducible-central?tab=readme-ov-file#reproducible-builds-for-maven-central-repository · Note
• https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/net/sourceforge/pmd/pmd-designer/pmd-designer-7.0.0.diffoscope · Note
• https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/net/sourceforge/pmd/pmd-designer/README.md · Note
• https://github.com/pmd/pmd-designer/commit/e87a45312753ec46b3e5576c6f6ac1f7de2f5891 · Note
• https://github.com/pmd/pmd-designer/commit/1548f5f27ba2981b890827fecbd0612fa70a0362 · Note
• https://twitter.com/CVEnew/status/1885370160980386124 · Twitter Post
• https://t.me/cvedetector/16967 · Telegram Post