CVE-2019-13990 (CNNVD-201907-1383)

CRITICAL
中文标题:
Terracotta Quartz Scheduler 代码问题漏洞
英文标题:
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3...
CVSS分数: 9.8
发布时间: 2019-07-26 00:00:00
漏洞类型: 代码问题
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

Terracotta Quartz Scheduler是一款开源的作业调度框架。 Terracotta Quartz Scheduler 2.3.0及之前版本中的xml/XMLSchedulingDataProcessor.java文件的‘initDocumentParser’函数存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。

英文描述:

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

CWE类型:
CWE-611
标签:
(暂无数据)
受影响产品
厂商 产品 版本 版本范围 平台 CPE
softwareag quartz * - - cpe:2.3:a:softwareag:quartz:*:*:*:*:*:*:*:*
oracle apache_batik_mapviewer 12.2.0.1 - - cpe:2.3:a:oracle:apache_batik_mapviewer:12.2.0.1:*:*:*:*:*:*:*
oracle apache_batik_mapviewer 18c - - cpe:2.3:a:oracle:apache_batik_mapviewer:18c:*:*:*:*:*:*:*
oracle apache_batik_mapviewer 19c - - cpe:2.3:a:oracle:apache_batik_mapviewer:19c:*:*:*:*:*:*:*
oracle banking_enterprise_originations 2.7.0 - - cpe:2.3:a:oracle:banking_enterprise_originations:2.7.0:*:*:*:*:*:*:*
oracle banking_enterprise_originations 2.8.0 - - cpe:2.3:a:oracle:banking_enterprise_originations:2.8.0:*:*:*:*:*:*:*
oracle banking_enterprise_product_manufacturing 2.7.0 - - cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0:*:*:*:*:*:*:*
oracle banking_enterprise_product_manufacturing 2.8.0 - - cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0:*:*:*:*:*:*:*
oracle banking_payments * - - cpe:2.3:a:oracle:banking_payments:*:*:*:*:*:*:*:*
oracle communications_ip_service_activator 7.3.0 - - cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:*
oracle communications_ip_service_activator 7.4.0 - - cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:*
oracle communications_session_route_manager * - - cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*
oracle customer_management_and_segmentation_foundation 18.0 - - cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*
oracle documaker * - - cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*
oracle enterprise_manager_base_platform 13.2.1.0 - - cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.1.0:*:*:*:*:*:*:*
oracle enterprise_manager_ops_center 12.4.0.0 - - cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
oracle flexcube_investor_servicing 12.1.0 - - cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*
oracle flexcube_investor_servicing 12.3.0 - - cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*
oracle flexcube_investor_servicing 12.4.0 - - cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*
oracle flexcube_investor_servicing 14.1.0 - - cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:*
oracle flexcube_investor_servicing 14.4.0 - - cpe:2.3:a:oracle:flexcube_investor_servicing:14.4.0:*:*:*:*:*:*:*
oracle flexcube_private_banking 12.0.0 - - cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
oracle flexcube_private_banking 12.1.0 - - cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
oracle fusion_middleware_mapviewer 12.2.1.3.0 - - cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:*
oracle google_guava_mapviewer 12.2.0.1 - - cpe:2.3:a:oracle:google_guava_mapviewer:12.2.0.1:*:*:*:*:*:*:*
oracle google_guava_mapviewer 18c - - cpe:2.3:a:oracle:google_guava_mapviewer:18c:*:*:*:*:*:*:*
oracle google_guava_mapviewer 19c - - cpe:2.3:a:oracle:google_guava_mapviewer:19c:*:*:*:*:*:*:*
oracle hyperion_infrastructure_technology 11.1.2.4 - - cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
oracle jd_edwards_enterpriseone_orchestrator * - - cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*
oracle primavera_unifier * - - cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
oracle primavera_unifier 16.1 - - cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
oracle primavera_unifier 16.2 - - cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
oracle primavera_unifier 18.8 - - cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
oracle retail_back_office 14.1 - - cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
oracle retail_central_office 14.1 - - cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
oracle retail_integration_bus 15.0 - - cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*
oracle retail_integration_bus 16.0 - - cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*
oracle retail_order_broker 15.0 - - cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*
oracle retail_order_broker 16.0 - - cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*
oracle retail_order_broker 18.0 - - cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:*
oracle retail_order_broker 19.0 - - cpe:2.3:a:oracle:retail_order_broker:19.0:*:*:*:*:*:*:*
oracle retail_point-of-service 14.1 - - cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*
oracle retail_returns_management 14.1 - - cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 15.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 16.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 17.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 18.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 19.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:*
oracle terracotta_quartz_scheduler_mapviewer 12.2.0.1 - - cpe:2.3:a:oracle:terracotta_quartz_scheduler_mapviewer:12.2.0.1:*:*:*:*:*:*:*
oracle terracotta_quartz_scheduler_mapviewer 18c - - cpe:2.3:a:oracle:terracotta_quartz_scheduler_mapviewer:18c:*:*:*:*:*:*:*
oracle terracotta_quartz_scheduler_mapviewer 19c - - cpe:2.3:a:oracle:terracotta_quartz_scheduler_mapviewer:19c:*:*:*:*:*:*:*
oracle webcenter_sites 12.2.1.3.0 - - cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
oracle webcenter_sites 12.2.1.4.0 - - cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
apache tomee 7.1.3 - - cpe:2.3:a:apache:tomee:7.1.3:*:*:*:*:*:*:*
netapp active_iq_unified_manager - - - cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
netapp cloud_secure_agent - - - cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*
atlassian jira_service_management 4.20.0 - - cpe:2.3:a:atlassian:jira_service_management:4.20.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.1 - - cpe:2.3:a:atlassian:jira_service_management:4.20.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.2 - - cpe:2.3:a:atlassian:jira_service_management:4.20.2:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.3 - - cpe:2.3:a:atlassian:jira_service_management:4.20.3:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.4 - - cpe:2.3:a:atlassian:jira_service_management:4.20.4:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.5 - - cpe:2.3:a:atlassian:jira_service_management:4.20.5:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.6 - - cpe:2.3:a:atlassian:jira_service_management:4.20.6:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.7 - - cpe:2.3:a:atlassian:jira_service_management:4.20.7:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.8 - - cpe:2.3:a:atlassian:jira_service_management:4.20.8:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.9 - - cpe:2.3:a:atlassian:jira_service_management:4.20.9:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.10 - - cpe:2.3:a:atlassian:jira_service_management:4.20.10:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.11 - - cpe:2.3:a:atlassian:jira_service_management:4.20.11:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.12 - - cpe:2.3:a:atlassian:jira_service_management:4.20.12:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.13 - - cpe:2.3:a:atlassian:jira_service_management:4.20.13:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.14 - - cpe:2.3:a:atlassian:jira_service_management:4.20.14:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.15 - - cpe:2.3:a:atlassian:jira_service_management:4.20.15:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.16 - - cpe:2.3:a:atlassian:jira_service_management:4.20.16:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.17 - - cpe:2.3:a:atlassian:jira_service_management:4.20.17:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.18 - - cpe:2.3:a:atlassian:jira_service_management:4.20.18:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.19 - - cpe:2.3:a:atlassian:jira_service_management:4.20.19:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.20 - - cpe:2.3:a:atlassian:jira_service_management:4.20.20:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.21 - - cpe:2.3:a:atlassian:jira_service_management:4.20.21:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.22 - - cpe:2.3:a:atlassian:jira_service_management:4.20.22:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.23 - - cpe:2.3:a:atlassian:jira_service_management:4.20.23:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.24 - - cpe:2.3:a:atlassian:jira_service_management:4.20.24:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.20.25 - - cpe:2.3:a:atlassian:jira_service_management:4.20.25:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.21.0 - - cpe:2.3:a:atlassian:jira_service_management:4.21.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.21.1 - - cpe:2.3:a:atlassian:jira_service_management:4.21.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.22.0 - - cpe:2.3:a:atlassian:jira_service_management:4.22.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.22.1 - - cpe:2.3:a:atlassian:jira_service_management:4.22.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.22.2 - - cpe:2.3:a:atlassian:jira_service_management:4.22.2:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.22.3 - - cpe:2.3:a:atlassian:jira_service_management:4.22.3:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.22.4 - - cpe:2.3:a:atlassian:jira_service_management:4.22.4:*:*:*:data_center:*:*:*
atlassian jira_service_management 4.22.6 - - cpe:2.3:a:atlassian:jira_service_management:4.22.6:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.0.0 - - cpe:2.3:a:atlassian:jira_service_management:5.0.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.1.0 - - cpe:2.3:a:atlassian:jira_service_management:5.1.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.1.1 - - cpe:2.3:a:atlassian:jira_service_management:5.1.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.2.0 - - cpe:2.3:a:atlassian:jira_service_management:5.2.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.2.1 - - cpe:2.3:a:atlassian:jira_service_management:5.2.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.3.0 - - cpe:2.3:a:atlassian:jira_service_management:5.3.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.3.1 - - cpe:2.3:a:atlassian:jira_service_management:5.3.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.3.2 - - cpe:2.3:a:atlassian:jira_service_management:5.3.2:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.3.3 - - cpe:2.3:a:atlassian:jira_service_management:5.3.3:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.0 - - cpe:2.3:a:atlassian:jira_service_management:5.4.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.1 - - cpe:2.3:a:atlassian:jira_service_management:5.4.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.2 - - cpe:2.3:a:atlassian:jira_service_management:5.4.2:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.3 - - cpe:2.3:a:atlassian:jira_service_management:5.4.3:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.4 - - cpe:2.3:a:atlassian:jira_service_management:5.4.4:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.5 - - cpe:2.3:a:atlassian:jira_service_management:5.4.5:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.6 - - cpe:2.3:a:atlassian:jira_service_management:5.4.6:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.7 - - cpe:2.3:a:atlassian:jira_service_management:5.4.7:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.8 - - cpe:2.3:a:atlassian:jira_service_management:5.4.8:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.4.9 - - cpe:2.3:a:atlassian:jira_service_management:5.4.9:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.5.1 - - cpe:2.3:a:atlassian:jira_service_management:5.5.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.6.0 - - cpe:2.3:a:atlassian:jira_service_management:5.6.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.7.0 - - cpe:2.3:a:atlassian:jira_service_management:5.7.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.7.1 - - cpe:2.3:a:atlassian:jira_service_management:5.7.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.8.0 - - cpe:2.3:a:atlassian:jira_service_management:5.8.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.8.1 - - cpe:2.3:a:atlassian:jira_service_management:5.8.1:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.9.0 - - cpe:2.3:a:atlassian:jira_service_management:5.9.0:*:*:*:data_center:*:*:*
atlassian jira_service_management 5.10.0 - - cpe:2.3:a:atlassian:jira_service_management:5.10.0:*:*:*:data_center:*:*:*
解决方案
中文解决方案:
(暂无数据)
英文解决方案:
(暂无数据)
临时解决方案:
(暂无数据)
参考链接
[tomee-dev] 20190830 Re: Quartz CVE-2019-13990 mailing-list
cve.org
访问
[tomee-dev] 20190830 Quartz CVE-2019-13990 mailing-list
cve.org
访问
[tomee-dev] 20190908 Re: Quartz CVE-2019-13990 mailing-list
cve.org
访问
[tomee-commits] 20190908 svn commit: r1866633 - /tomee/deps/trunk/quartz-openejb-shade/pom.xml mailing-list
cve.org
访问
[tomee-dev] 20190923 Re: [VOTE] Release quartz-openejb-shade 2.2.4 mailing-list
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
[tomee-commits] 20200720 [jira] [Created] (TOMEE-2886) Update quartz-scheduler to mitigate CVE-2019-13990 mailing-list
cve.org
访问
[tomee-commits] 20200720 [jira] [Commented] (TOMEE-2886) Update quartz-scheduler to mitigate CVE-2019-13990 mailing-list
cve.org
访问
[tomee-commits] 20200720 [jira] [Assigned] (TOMEE-2886) Update quartz-scheduler to mitigate CVE-2019-13990 mailing-list
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
CVSS评分详情
3.1 (adp)
CRITICAL
9.8
CVSS向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2019-07-26 00:00:00
修改时间:
2024-10-15 18:22:20
创建时间:
2025-11-11 15:35:33
更新时间:
2025-11-11 15:54:38
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2019-13990 2025-11-11 15:20:01 2025-11-11 07:35:33
NVD nvd_CVE-2019-13990 2025-11-11 14:56:24 2025-11-11 07:44:05
CNNVD cnnvd_CNNVD-201907-1383 2025-11-11 15:10:14 2025-11-11 07:54:38
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:54:38
vulnerability_type: 未提取 → 代码问题; cnnvd_id: 未提取 → CNNVD-201907-1383; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 代码问题
  • cnnvd_id: 未提取 -> CNNVD-201907-1383
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:44:05
affected_products_count: 0 → 117; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • affected_products_count: 0 -> 117
  • data_sources: ['cve'] -> ['cve', 'nvd']