CVE-2019-13990

Fixed in a distro release EPSS 17%CVSS 9.8

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Published 2019-07-26 · CVE record · OSV

Products: softwareag quartz, oracle apache_batik_mapviewer, oracle banking_enterprise_originations, oracle banking_enterprise_product_manufacturing, oracle banking_payments, oracle communications_ip_service_activator, oracle communications_session_route_manager, oracle customer_management_and_segmentation_foundation, oracle documaker, oracle enterprise_manager_base_platform, oracle enterprise_manager_ops_center, Oracle FLEXCUBE Investor Servicing, oracle flexcube_private_banking, oracle fusion_middleware_mapviewer, oracle google_guava_mapviewer, oracle hyperion_infrastructure_technology, oracle jd_edwards_enterpriseone_orchestrator, oracle primavera_unifier, oracle retail_back_office, oracle retail_central_office, oracle retail_integration_bus, oracle retail_order_broker, oracle retail_point-of-service, oracle retail_returns_management, oracle retail_xstore_point_of_service, oracle terracotta_quartz_scheduler_mapviewer, oracle webcenter_sites, apache tomee, netapp active_iq_unified_manager, netapp cloud_secure_agent, atlassian jira_service_management

Fixed upstream

Distro releases