LiveActive security incident?Get immediate response
CVE Record

CVE-2019-13990: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allo...

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Quartz Scheduler could process a malicious XML job description in a way that lets an attacker make the server read or interact with unintended resources. The CVSS score is critical, but the provided sources do not show confirmed active exploitation.

Executive priority

Prioritize within critical dependency remediation, especially for exposed systems or products that import Quartz XML job definitions. Absence from KEV lowers emergency evidence, not severity.

Technical view

CVE-2019-13990 is an XXE issue in initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0. The weakness is CWE-611 and is scored CVSS 3.1 9.8 with network attack vector, no privileges, and no user interaction.

Likely exposure

Most likely exposure is Java software that embeds Quartz Scheduler through 2.3.0 and accepts or processes XML job scheduling data. The source bundle also references Apache TomEE, Oracle, NetApp, and Atlassian advisories, so dependency and vendor-product checks are important.

Exploitation context

The sources describe XXE through a job description but do not provide evidence of active exploitation. KEV status is false in the bundle. Treat internet-reachable or tenant-controlled job import paths as higher concern, but validate actual reachability before assuming exposure.

Researcher notes

The bundle lacks a complete CPE list and does not name a Quartz fixed version. Use the CVE description, GitHub issue, and downstream advisory references to scope affected deployments without assuming every Quartz user is reachable.

Mitigation direction

  • Identify direct and transitive Quartz Scheduler versions in SBOMs and dependency manifests.
  • Upgrade affected Quartz Scheduler use according to vendor or maintainer guidance.
  • Review Apache TomEE, Oracle, NetApp, and Atlassian advisories if those products are present.
  • Restrict who can submit or import XML job descriptions.
  • Check XML parser hardening guidance from the relevant product vendor.

Validation and detection

  • Search applications and SBOMs for Quartz Scheduler through 2.3.0.
  • Confirm whether XMLSchedulingDataProcessor or XML job import features are used.
  • Map any job-description upload or import path to authentication and network exposure.
  • Check vendor advisories for fixed versions in bundled products.
  • Review logs for unusual XML job import activity where available.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-611: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-13990 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
18Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2019-13990Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-611

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-611 · source CWE mapping

Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs