Login Request a demo
Critical severity · published Jul 26, 2019
CVE-2019-13990
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description
9.8
CVSS
16.6%
EPSS
No
On KEV
Description
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
AB
Apache Batik Mapviewer · Oracle
12.2.0.1; 18c; 19c · source: NVD
BE
Banking Enterprise Originations · Oracle
2.7.0; 2.8.0 · source: NVD
BE
Banking Enterprise Product Manufacturing · Oracle
2.7.0; 2.8.0 · source: NVD
BP
Banking Payments · Oracle
14.1.0 through 14.4.0 · source: NVD
CS
Cloud Secure Agent · Netapp
All versions, or not specified · source: NVD
CI
Communications IP Service Activator · Oracle
7.3.0; 7.4.0 · source: NVD
CS
Communications Session Route Manager · Oracle
8.2.0 through 8.2.2 · source: NVD
CM
Customer Management And Segmentation Foundation · Oracle
18.0 · source: NVD
DO
Documaker · Oracle
12.6.0 through 12.6.4 · source: NVD
EM
Enterprise Manager Base Platform · Oracle
13.2.1.0 · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.4.0.0 · source: NVD
Affected product
TO
Tomee
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13990
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13990
Third Party Advisory
https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html
Issue Tracking
https://github.com/quartz-scheduler/quartz/issues/467
Third Party Advisory
https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E
Issue Tracking
https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E
Issue Tracking
https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E
Issue Tracking
https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E
More from Tomee
9.8
CVE-2020-13931
If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX…
9.8
CVE-2020-11969
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not…
9.8
CVE-2016-0779
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object
7.5
CVE-2021-40690
Bypass of the secureValidation property
7.5
CVE-2021-30468
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an…