CRITICAL
libquartz: XXE attacks via job description
Published Jul 26, 2019
9.8
CRITICALCVSS 3.1
EPSS 16.20%
Description
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Affected products
No data.
Configuration 1
- < 2.3.2
Configuration 2
OR
- 12.2.0.1
- 18c
- 19c
- 2.7.0
- 2.8.0
- 2.7.0
- 2.8.0
- ≥ 14.1.0 · ≤ 14.4.0
- 7.3.0
- 7.4.0
- ≥ 8.2.0 · ≤ 8.2.2
- 18.0
- ≥ 12.6.0 · ≤ 12.6.4
- 13.2.1.0
- 12.4.0.0
- 12.1.0
- 12.3.0
- 12.4.0
- 14.1.0
- 14.4.0
- 12.0.0
- 12.1.0
- 12.2.1.3.0
- 12.2.0.1
- 18c
- 19c
- 11.1.2.4
- ≤ 9.2.5.3
- ≥ 17.7 · ≤ 17.12
- 16.1
- 16.2
- 18.8
- 14.1
- 14.1
- 15.0
- 16.0
- 15.0
- 16.0
- 18.0
- 19.0
- 14.1
- 14.1
- 15.0
- 16.0
- 17.0
- 18.0
- 19.0
- 12.2.0.1
- 18c
- 19c
- 12.2.1.3.0
- 12.2.1.4.0
Configuration 4
OR
- n/a
- n/a
- n/a
- n/a
Configuration 5
OR
- 4.20.0
- 4.20.0
- 4.20.1
- 4.20.1
- 4.20.2
- 4.20.2
- 4.20.3
- 4.20.3
- 4.20.4
- 4.20.4
- 4.20.5
- 4.20.5
- 4.20.6
- 4.20.6
- 4.20.7
- 4.20.7
- 4.20.8
- 4.20.8
- 4.20.9
- 4.20.9
- 4.20.10
- 4.20.10
- 4.20.11
- 4.20.11
- 4.20.12
- 4.20.12
- 4.20.13
- 4.20.13
- 4.20.14
- 4.20.14
- 4.20.15
- 4.20.15
- 4.20.16
- 4.20.16
- 4.20.17
- 4.20.17
- 4.20.18
- 4.20.18
- 4.20.19
- 4.20.19
- 4.20.20
- 4.20.20
- 4.20.21
- 4.20.21
- 4.20.22
- 4.20.22
- 4.20.23
- 4.20.23
- 4.20.24
- 4.20.24
- 4.20.25
- 4.20.25
- 4.21.0
- 4.21.0
- 4.21.1
- 4.21.1
- 4.22.0
- 4.22.0
- 4.22.1
- 4.22.1
- 4.22.2
- 4.22.2
- 4.22.3
- 4.22.3
- 4.22.4
- 4.22.4
- 4.22.6
- 4.22.6
- 5.0.0
- 5.0.0
- 5.1.0
- 5.1.0
- 5.1.1
- 5.1.1
- 5.2.0
- 5.2.0
- 5.2.1
- 5.2.1
- 5.3.0
- 5.3.0
- 5.3.1
- 5.3.1
- 5.3.2
- 5.3.2
- 5.3.3
- 5.3.3
- 5.4.0
- 5.4.0
- 5.4.1
- 5.4.1
- 5.4.2
- 5.4.2
- 5.4.3
- 5.4.3
- 5.4.4
- 5.4.4
- 5.4.5
- 5.4.5
- 5.4.6
- 5.4.6
- 5.4.7
- 5.4.7
- 5.4.8
- 5.4.8
- 5.4.9
- 5.4.9
- 5.5.1
- 5.5.1
- 5.6.0
- 5.6.0
- 5.7.0
- 5.7.0
- 5.7.1
- 5.7.1
- 5.8.0
- 5.8.0
- 5.8.1
- 5.8.1
- 5.9.0
- 5.9.0
- 5.10.0
- 5.10.0
No data.
Red Hat Decision Manager 7
quartz
Fixed · RHSA-2020:3196
Red Hat Fuse 7.8.0
quartz
Fixed · RHSA-2020:5568
Red Hat Process Automation 7
quartz
Fixed · RHSA-2020:3197
Red Hat Virtualization Engine 4.4
rhvm-dependencies-0:4.4.0-1.el8ev
Fixed · RHSA-2020:3247
Red Hat JBoss Fuse Service Works 6
quartz
Out of support scope
Red Hat Satellite 5
quartz
Out of support scope
Red Hat Satellite 6
quartz
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Decision Manager 7 | quartz | Fixed | RHSA-2020:3196 |
| Red Hat Fuse 7.8.0 | quartz | Fixed | RHSA-2020:5568 |
| Red Hat Process Automation 7 | quartz | Fixed | RHSA-2020:3197 |
| Red Hat Virtualization Engine 4.4 | rhvm-dependencies-0:4.4.0-1.el8ev | Fixed | RHSA-2020:3247 |
| Red Hat JBoss Fuse Service Works 6 | quartz | Out of support scope | n/a |
| Red Hat Satellite 5 | quartz | Out of support scope | n/a |
| Red Hat Satellite 6 | quartz | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Satellite 6 uses a vulnerable version of libquartz as a dependency for Candlepin. However, the <job><descrition> entry is not used, and the vulnerability can not be triggered. An update may fix the code in the future.
Metrics
No CVSS v4.0 score for this CVE.
9.8 CRITICAL NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
1 other source (Red Hat) ▾
8.1 HIGH Red Hat
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
No CVSS v3.0 score for this CVE.
7.5 HIGH NVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
TotalDecision
n/aAssessed Oct 15, 2024 · SSVC 2.0.3
16.20% 0.16200
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.16200
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (38 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 16.20% (0.16200) | 96.85th | v5 (v2026.06.15) |
| Jun 15, 2026 | 16.63% (0.16628) | 96.60th | v5 (v2026.06.15) |
| May 22, 2026 | 13.47% (0.13467) | 94.30th | v4 (v2025.03.14) |
| Mar 20, 2026 | 17.24% (0.17243) | 94.96th | v4 (v2025.03.14) |
| Nov 21, 2025 | 7.95% (0.07947) | 91.70th | v4 (v2025.03.14) |
| Nov 18, 2025 | 14.71% (0.14708) | 93.87th | v4 (v2025.03.14) |
| Oct 16, 2025 | 7.95% (0.07947) | 91.63th | v4 (v2025.03.14) |
| Jul 14, 2025 | 10.42% (0.10416) | 92.86th | v4 (v2025.03.14) |
| Apr 6, 2025 | 7.95% (0.07947) | 91.29th | v4 (v2025.03.14) |
| Mar 30, 2025 | 10.42% (0.10416) | 92.50th | v4 (v2025.03.14) |
| Mar 29, 2025 | 30.85% (0.30847) | 94.85th | v4 (v2025.03.14) |
| Mar 28, 2025 | 10.42% (0.10416) | 92.50th | v4 (v2025.03.14) |
| Mar 27, 2025 | 30.85% (0.30847) | 96.08th | v4 (v2025.03.14) |
| Mar 20, 2025 | 10.42% (0.10416) | 92.59th | v4 (v2025.03.14) |
| Mar 19, 2025 | 30.85% (0.30847) | 96.16th | v4 (v2025.03.14) |
| Mar 17, 2025 | 10.42% (0.10416) | 92.65th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.77% (0.00773) | 81.99th | v3 (v2023.03.01) |
| Jul 19, 2024 | 0.77% (0.00773) | 81.50th | v3 (v2023.03.01) |
| May 22, 2024 | 0.75% (0.00751) | 80.99th | v3 (v2023.03.01) |
| Dec 23, 2023 | 0.75% (0.00751) | 78.96th | v3 (v2023.03.01) |
| Nov 8, 2023 | 1.14% (0.01138) | 83.05th | v3 (v2023.03.01) |
| Oct 28, 2023 | 0.38% (0.00384) | 70.04th | v3 (v2023.03.01) |
| Jul 8, 2023 | 0.31% (0.00311) | 65.94th | v3 (v2023.03.01) |
| Jun 16, 2023 | 0.27% (0.00270) | 63.16th | v3 (v2023.03.01) |
| May 30, 2023 | 0.31% (0.00314) | 65.83th | v3 (v2023.03.01) |
| May 8, 2023 | 0.31% (0.00307) | 65.33th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.35% (0.00354) | 67.52th | v3 (v2023.03.01) |
| Mar 6, 2023 | 7.77% (0.07767) | 93.09th | v2 (v2022.01.01) |
| Mar 4, 2023 | 7.77% (0.07767) | 93.09th | v2 (v2022.01.01) |
| Apr 26, 2022 | 5.24% (0.05242) | 88.78th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.69% (0.02686) | 81.17th | v2 (v2022.01.01) |
| Feb 4, 2022 | 24.56% (0.24563) | 95.26th | v2 (v2022.01.01) |
| Feb 3, 2022 | 13.21% (0.13208) | 89.07th | v1 |
| Jan 6, 2022 | 13.21% (0.13208) | 88.94th | v1 |
| Oct 21, 2021 | 3.28% (0.03281) | 81.80th | v1 |
| Sep 1, 2021 | 3.08% (0.03080) | 81.27th | v1 |
| Jul 21, 2021 | 3.08% (0.03080) | 0.00th | v1 |
| Apr 14, 2021 | 2.88% (0.02880) | 0.00th | v1 |
Weaknesses (1)
References (33)
- https://access.redhat.com/security/cve/CVE-2019-13990 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1801149 Issue Tracking
- https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html Third Party Advisory
- https://github.com/advisories/GHSA-9qcf-c26r-x5rf Advisory
- https://github.com/quartz-scheduler/quartz/commit/13c1d45aa1db15d0fa0e4997139c99ba219be551
- https://github.com/quartz-scheduler/quartz/issues/467 Issue TrackingThird Party Advisory
- https://github.com/quartz-scheduler/quartz/pull/501
- https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E mailing-listThird Party Advisory
- https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E mailing-listIssue Tracking
- https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E mailing-listIssue Tracking
- https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E mailing-listIssue Tracking
- https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf%40%3Ccommits.tomee.apache.org%3E mailing-listPatch
- https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a%40%3Ccommits.tomee.apache.org%3E mailing-listPatch
- https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f784950bf44cf%40%3Ccommits.tomee.apache.org%3E mailing-listIssue Tracking
- https://lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f784950bf44cf@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce923bf8aa%40%3Ccommits.tomee.apache.org%3E mailing-listIssue Tracking
- https://lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce923bf8aa@%3Ccommits.tomee.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2019-13990
- https://security.netapp.com/advisory/ntap-20221028-0002 Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGQUARTZSCHEDULER-461170
- https://www.cve.org/CVERecord?id=CVE-2019-13990
- https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jul 26, 2019
Updated Oct 15, 2024
Reserved Jul 19, 2019
Link CVE-2019-13990
CISA Vulnrichment
GHSA-9QCF-C26R-X5RF Updated Oct 15, 2024