Back
CVE-2019-13990
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job…
Critical9.8EPSS 16.6%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 16.6% · top 3.0% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
n/a
- affected n/a
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.quartz-scheduler:quartzGHSA-9qcf-c26r-x5rf (opens in a new tab)
References (17)
- [tomee-dev] 20190830 Re: Quartz CVE-2019-13990 (opens in a new tab)mailing-listx_transferred
- [tomee-dev] 20190830 Quartz CVE-2019-13990 (opens in a new tab)mailing-listx_transferred
- [tomee-dev] 20190908 Re: Quartz CVE-2019-13990 (opens in a new tab)mailing-listx_transferred
- [tomee-commits] 20190908 svn commit: r1866633 - /tomee/deps/trunk/quartz-openejb-shade/pom.xml (opens in a new tab)mailing-listx_transferred
- [tomee-dev] 20190923 Re: [VOTE] Release quartz-openejb-shade 2.2.4 (opens in a new tab)mailing-listx_transferred
- https://www.oracle.com/security-alerts/cpuapr2020.html (opens in a new tab)x_transferred
- https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_transferred
- https://github.com/quartz-scheduler/quartz/issues/467 (opens in a new tab)x_transferred
- [tomee-commits] 20200720 [jira] [Created] (TOMEE-2886) Update quartz-scheduler to mitigate CVE-2019-13990 (opens in a new tab)mailing-listx_transferred
- [tomee-commits] 20200720 [jira] [Commented] (TOMEE-2886) Update quartz-scheduler to mitigate CVE-2019-13990 (opens in a new tab)mailing-listx_transferred
- [tomee-commits] 20200720 [jira] [Assigned] (TOMEE-2886) Update quartz-scheduler to mitigate CVE-2019-13990 (opens in a new tab)mailing-listx_transferred
- https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_transferred
- https://www.oracle.com/security-alerts/cpujan2021.html (opens in a new tab)x_transferred
- https://www.oracle.com//security-alerts/cpujul2021.html (opens in a new tab)x_transferred
- https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20221028-0002/ (opens in a new tab)x_transferred
- https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-9qcf-c26r-x5rf (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-13990)Record last updated .