{"cve":"CVE-2019-13990","nvd":{"published":"2019-07-26T19:15:11.730","modified":"2026-06-17T02:17:34.603","status":"Modified","description":"initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-611"],"references":["https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html","https://github.com/quartz-scheduler/quartz/issues/467","https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E"],"products":["apache:tomee","atlassian:jira_service_management","netapp:active_iq_unified_manager","netapp:cloud_secure_agent","oracle:apache_batik_mapviewer","oracle:banking_enterprise_originations","oracle:banking_enterprise_product_manufacturing","oracle:banking_payments","oracle:communications_ip_service_activator","oracle:communications_session_route_manager","oracle:customer_management_and_segmentation_foundation","oracle:documaker","oracle:enterprise_manager_base_platform","oracle:enterprise_manager_ops_center","oracle:flexcube_investor_servicing","oracle:flexcube_private_banking","oracle:fusion_middleware_mapviewer","oracle:google_guava_mapviewer","oracle:hyperion_infrastructure_technology","oracle:jd_edwards_enterpriseone_orchestrator","oracle:primavera_unifier","oracle:retail_back_office","oracle:retail_central_office","oracle:retail_integration_bus","oracle:retail_order_broker","oracle:retail_point-of-service","oracle:retail_returns_management","oracle:retail_xstore_point_of_service","oracle:terracotta_quartz_scheduler_mapviewer","oracle:webcenter_sites","softwareag:quartz"],"source":"nvd","synced_at":"2026-10-19T20:58:11.797917892+00:00"},"epss":{"cve":"CVE-2019-13990","score":0.16628,"percentile":0.97019,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9qcf-c26r-x5rf","url":"https://osv.dev/vulnerability/GHSA-9qcf-c26r-x5rf","summary":"XML external entity injection in Terracotta Quartz Scheduler","modified":"2024-10-15T23:39:47.179091Z","packages":[{"ecosystem":"Maven","name":"org.quartz-scheduler:quartz","purl":"pkg:maven/org.quartz-scheduler/quartz","ranges":["<2.3.2"],"fixed":["2.3.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}