{
    "id": "CVE-2019-13990",
    "published": "2019-07-26 19:15:11",
    "last_modified": "2026-06-17 02:17:34",
    "cvss_score": "9.8",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": "CWE-611",
    "description": "initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.",
    "epss_score": "0.16200",
    "epss_percentile": "0.96851",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 0,
    "updated_at": "2026-10-03 18:17:22",
    "priority": {
        "rank": 2,
        "label": "Patch early",
        "why": "EPSS 16.2% — above the 10% action threshold."
    },
    "products": [
        {
            "vendor": "apache",
            "product": "tomee"
        },
        {
            "vendor": "atlassian",
            "product": "jira_service_management"
        },
        {
            "vendor": "netapp",
            "product": "active_iq_unified_manager"
        },
        {
            "vendor": "netapp",
            "product": "cloud_secure_agent"
        },
        {
            "vendor": "oracle",
            "product": "apache_batik_mapviewer"
        },
        {
            "vendor": "oracle",
            "product": "banking_enterprise_originations"
        },
        {
            "vendor": "oracle",
            "product": "banking_enterprise_product_manufacturing"
        },
        {
            "vendor": "oracle",
            "product": "banking_payments"
        },
        {
            "vendor": "oracle",
            "product": "communications_ip_service_activator"
        },
        {
            "vendor": "oracle",
            "product": "communications_session_route_manager"
        },
        {
            "vendor": "oracle",
            "product": "customer_management_and_segmentation_foundation"
        },
        {
            "vendor": "oracle",
            "product": "documaker"
        },
        {
            "vendor": "oracle",
            "product": "enterprise_manager_base_platform"
        },
        {
            "vendor": "oracle",
            "product": "enterprise_manager_ops_center"
        },
        {
            "vendor": "oracle",
            "product": "flexcube_investor_servicing"
        },
        {
            "vendor": "oracle",
            "product": "flexcube_private_banking"
        },
        {
            "vendor": "oracle",
            "product": "fusion_middleware_mapviewer"
        },
        {
            "vendor": "oracle",
            "product": "google_guava_mapviewer"
        },
        {
            "vendor": "oracle",
            "product": "hyperion_infrastructure_technology"
        },
        {
            "vendor": "oracle",
            "product": "jd_edwards_enterpriseone_orchestrator"
        },
        {
            "vendor": "oracle",
            "product": "primavera_unifier"
        },
        {
            "vendor": "oracle",
            "product": "retail_back_office"
        },
        {
            "vendor": "oracle",
            "product": "retail_central_office"
        },
        {
            "vendor": "oracle",
            "product": "retail_integration_bus"
        },
        {
            "vendor": "oracle",
            "product": "retail_order_broker"
        },
        {
            "vendor": "oracle",
            "product": "retail_point-of-service"
        },
        {
            "vendor": "oracle",
            "product": "retail_returns_management"
        },
        {
            "vendor": "oracle",
            "product": "retail_xstore_point_of_service"
        },
        {
            "vendor": "oracle",
            "product": "terracotta_quartz_scheduler_mapviewer"
        },
        {
            "vendor": "oracle",
            "product": "webcenter_sites"
        },
        {
            "vendor": "softwareag",
            "product": "quartz"
        }
    ],
    "kev_detail": null,
    "exploits": [],
    "refs_list": [
        "https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html",
        "https://github.com/quartz-scheduler/quartz/issues/467",
        "https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf%40%3Ccommits.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a%40%3Ccommits.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f784950bf44cf%40%3Ccommits.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce923bf8aa%40%3Ccommits.tomee.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20221028-0002/",
        "https://www.oracle.com//security-alerts/cpujul2021.html",
        "https://www.oracle.com/security-alerts/cpuapr2020.html",
        "https://www.oracle.com/security-alerts/cpujan2021.html",
        "https://www.oracle.com/security-alerts/cpujul2020.html",
        "https://www.oracle.com/security-alerts/cpuoct2020.html",
        "https://www.oracle.com/security-alerts/cpuoct2021.html",
        "https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html",
        "https://github.com/quartz-scheduler/quartz/issues/467",
        "https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf%40%3Ccommits.tomee.apache.org%3E",
        "https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a%40%3Ccommits.tomee.apache.org%3E"
    ]
}