CVE-2019-13990 — XML External Entity (XXE) Injection in Quartz

CWE-611 — XML External Entity (XXE) Injection17 documents8 sources
Severity
9.8CRITICALNVD
EPSS
17.2%
top 4.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
29
Softwareag QuartzOracle Banking PaymentsOracle Communications Session Route Manager+26 more
Timeline
PublishedJul 26
Latest updateApr 15

Description

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages29 packages

▶NVDsoftwareag/quartz< 2.3.2
▶NVDoracle/documaker12.6.0 — 12.6.4
▶NVDoracle/banking_payments14.1.0 — 14.4.0
▶NVDoracle/primavera_unifier17.7 — 17.12+3

Patches

Patch: lists.apache.org ↗Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

4
GHSA
XML external entity injection in Terracotta Quartz Scheduler↗2020-07-01
▶
OSV
XML external entity injection in Terracotta Quartz Scheduler↗2020-07-01
▶
CVEList
CVE-2019-13990: initDocumentParser in xml/XMLSchedulingDataProcessor↗2019-07-26
▶
OSV
CVE-2019-13990: initDocumentParser in xml/XMLSchedulingDataProcessor↗2019-07-26
▶

📋Vendor Advisories

10
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Quartz) — CVE-2019-13990↗2024-04-15
▶
Oracle
Oracle Oracle Analytics Risk Matrix: Framework (Quartz) — CVE-2019-13990↗2023-07-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: WebCenter Sites (Terracotta Quartz Scheduler) — CVE-2019-13990↗2021-10-15
▶
Oracle
Oracle Oracle JD Edwards Risk Matrix: E1 IOT Orchestrator Security (Quartz) — CVE-2019-13990↗2021-07-15
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Connector Framework (Quartz) — CVE-2019-13990↗2021-01-15
▶

💬Community

2
Bugzilla
CVE-2019-13990 quartz: libquartz: XXE attacks via job description [fedora-all]↗2020-03-18
▶
Bugzilla
CVE-2019-13990 libquartz: XXE attacks via job description↗2020-02-10
▶
CVE-2019-13990 — XML External Entity (XXE) Injection | cvebase