CVE-2019-13990
XML external entity injection in Terracotta Quartz Scheduler
9.8 CriticalPublic exploitFix available
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
16.6%Up 13.7 points since Apr 14, 2021
What each source reports
NVD Score used
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
CVE-2019-13990- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
CVE-2019-13990- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2020-0548
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
EUVD-2020-0548- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9qcf-c26r-x5rf
XML external entity injection in Terracotta Quartz Scheduler
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
GHSA-9qcf-c26r-x5rf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
CVE-2019-13990- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-13990
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
DEBIAN-CVE-2019-13990- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-9qcf-c26r-x5rf
XML external entity injection in Terracotta Quartz Scheduler
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
GHSA-9qcf-c26r-x5rf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVRHSA-2020:3247
Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update
- Record
RHSA-2020:3247- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13990
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- Record
UBUNTU-CVE-2019-13990- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1778028240 No score
TuxCare security update for org.quartz-scheduler:quartz (1 CVE)
TuxCare rebuilt org.quartz-scheduler:quartz to address 1 CVE. Fixed in 1.8.5-tuxcare.1.
- Record
CLSA-2026-1778028240- Updated
- 2026-11-02
OSVMGASA-2021-0133 No score
Updated quartz packages fix a security vulnerability
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description (CVE-2019-13990).
- Record
MGASA-2021-0133- Updated
- 2026-11-02
OSVSUSE-SU-2020:0984-1 No score
Security update for quartz
This update for quartz fixes the following issues:
- CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser (bsc#1143227).
- Record
SUSE-SU-2020:0984-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1009-1 No score
Security update for quartz
This update for quartz fixes the following issues:
- CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser (bsc#1143227).
- Record
SUSE-SU-2020:1009-1- Updated
- 2026-11-02
Affected products
- softwareag quartz
- apache tomee
- atlassian jira service management
- netapp active iq unified manager
- netapp cloud secure agent
- oracle apache batik mapviewer
- oracle banking enterprise originations
- oracle banking enterprise product manufacturing
- oracle banking payments
- oracle communications ip service activator
- oracle communications session route manager
- oracle customer management and segmentation foundation
Show 19 moreShow less
- oracle documaker
- oracle enterprise manager base platform
- oracle enterprise manager ops center
- oracle flexcube investor servicing
- oracle flexcube private banking
- oracle fusion middleware mapviewer
- oracle google guava mapviewer
- oracle hyperion infrastructure technology
- oracle jd edwards enterpriseone orchestrator
- oracle primavera unifier
- oracle retail back office
- oracle retail central office
- oracle retail integration bus
- oracle retail order broker
- oracle retail point-of-service
- oracle retail returns management
- oracle retail xstore point of service
- oracle terracotta quartz scheduler mapviewer
- oracle webcenter sites
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.quartz-scheduler:quartzMaven |
before 2.3.2 | 2.3.2 |
org.quartz-scheduler:quartzTuxCare:Maven |
1.8.5 up to 1.8.5-tuxcare.1 | 1.8.5-tuxcare.1 |
libquartz-javaDebian:12 |
before 1:1.8.6-8 | 1:1.8.6-8 |
libquartz-javaDebian:13 |
before 1:1.8.6-8 | 1:1.8.6-8 |
libquartz-javaDebian:14 |
before 1:1.8.6-8 | 1:1.8.6-8 |
libquartz2-javaDebian:12 |
before 2.3.0-3 | 2.3.0-3 |
libquartz2-javaDebian:13 |
before 2.3.0-3 | 2.3.0-3 |
libquartz2-javaDebian:14 |
before 2.3.0-3 | 2.3.0-3 |
org.quartz-scheduler:quartzMaven |
before 2.3.2, plus listed versions 1.7.21.7.31.8.01.8.11.8.2 Show 21 moreShow less1.8.31.8.41.8.51.8.62.0.02.0.12.0.22.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.72.2.02.2.12.2.22.2.32.3.02.3.1 |
2.3.2 |
quartzMageia:7 |
before 2.2.1-9.1.mga7 | 2.2.1-9.1.mga7 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
novncRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:1.1.0-1.el8ost | 0:1.1.0-1.el8ost |
ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-api-explorerRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:0.0.6-1.el8ev | 0:0.0.6-1.el8ev |
ovirt-engine-backendRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-dbscriptsRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-health-check-bundlerRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-restapiRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setupRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-baseRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-cinderlibRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-imageioRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-ovirt-engine-commonRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-toolsRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-tools-backupRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-webadmin-portalRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
python3-ovirt-engine-libRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
rhvmRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
rhvm-dependenciesRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.0-1.el8ev | 0:4.4.0-1.el8ev |
ovirt-engine-ui-extensionsRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:1.2.2-1.el8ev | 0:1.2.2-1.el8ev |
quartzSUSE:Manager Server Module 4.0 |
before 2.3.0-4.3.1 | 2.3.0-4.3.1 |
quartzSUSE:Manager Server 3.2 |
before 2.3.0-14.3.1 | 2.3.0-14.3.1 |
libquartz-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1:1.7.3-51:1.8.6-1 |
None known |
libquartz-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.8.6-41:1.8.6-51:1.8.6-6~18.04 |
None known |
libquartz2-javaUbuntu:18.04:LTS |
All versions, plus listed versions 2.2.3-22.2.3-3 |
None known |
libquartz-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1:1.8.6-6 |
None known |
libquartz2-javaUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.0-2 |
None known |
libquartz-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.8.6-6 |
None known |
libquartz-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.8.6-8 |
None known |
libquartz-javaUbuntu:25.10 |
All versions, plus listed versions 1:1.8.6-8 |
None known |
libquartz-javaUbuntu:26.10 |
All versions, plus listed versions 1:1.8.6-8ubuntu1 |
None known |
libquartz-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.8.6-81:1.8.6-8ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | epicosy/Quartz-1 | 2024-05-31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13990 is a critical vulnerability (CVSS 9.8) in Softwareag Quartz, published July 26, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.6%, the 97th percentile. Fixed in org.quartz-scheduler:quartz 2.3.2.
References
lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E
oracle.com/security-alerts/cpuapr2020.html
Show 194 moreShow less
github.com/quartz-scheduler/quartz/issues/467
security.netapp.com/advisory/ntap-20221028-0002
confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html
nvd.nist.gov/vuln/detail/CVE-2019-13990
snyk.io/vuln/SNYK-JAVA-ORGQUARTZSCHEDULER-461170
security-tracker.debian.org/tracker/CVE-2019-13990
advisories.mageia.org/MGASA-2021-0133.html
bugs.mageia.org/show_bug.cgi?id=26481
lists.suse.com/pipermail/sle-security-updates/2020-April/006708.html
access.redhat.com/errata/RHSA-2020:3247
bugzilla.redhat.com/show_bug.cgi?id=1080097
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3247.json
cve.org/CVERecord?id=CVE-2017-18635
blog.jquery.com/2020/04/10/jquery-3-5-0-released
cisa.gov/known-exploited-vulnerabilities-catalog
suse.com/support/update/announcement/2020/suse-su-20200984-1
bugzilla.suse.com/1143227
ubuntu.com/security/CVE-2019-13990
This page doesn't list everything
Left out here: 114 references. The JSON record has them.