CVE-2019-13990 Quartz
| Affected software | Quartz |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 2.3.2 |
| Weakness | XML external entity (XXE) (CWE-611) |
| Published | 26 Jul 2019 |
| Updated | 17 Jun 2026 |
Description
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 17% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | quartz with CVE-2019-13990 | 2024-05-31 |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2024 ↗ | CPU | 2024-Q2 | Oracle Fusion Middleware / Directory Integration Platform (Quartz) (12.2.1.4.0) Oracle Fusion Middleware / Third Party (Quartz) (12.2.1.4.0) |
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Analytics / Framework (Quartz) (12.2.1.4.0) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Fusion Middleware / WebCenter Sites (Terracotta Quartz Scheduler) (12.2.1.3.0, 12.2.1.4.0) Oracle Insurance Applications / Development tools (Terracotta Quartz Scheduler) (12.6.0 - 12.6.4) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle JD Edwards / E1 IOT Orchestrator Security (Quartz) (9.2.5.3 and Prior) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Enterprise Manager / Connector Framework (Quartz) (13.2.1.0) Oracle Hyperion / Common Security (Quartz) (11.1.2.4) |
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Communications / Core (Quartz Scheduler) (8.2.0-8.2.2) Oracle Enterprise Manager / Agent Provisioning (Quartz Scheduler) (12.4.0.0) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Communications Applications / Netwok Processor Configuration Management (Terracotta Quartz Scheduler) (7.3.0, 7.4.0) Oracle Database Server / MapViewer (Terracotta Quartz Scheduler, Apache Batik, Google Guava) (12.2.0.1, 18c, 19c) Oracle's note: The CVE-2019-13990 and other CVEs listed for this patch are not exploitable in the context of Oracle Spatial and Graph MapViewer product, thus the CVSS score is 0.0. Oracle Financial Services Applications / Core (Terracotta Quartz Scheduler) (12.0.0, 12.1.0) Oracle Financial Services Applications / Core (Terracotta Quartz Scheduler) (14.1.0-14.4.0) Oracle Financial Services Applications / Infrastructure (Terracotta Quartz Scheduler) (12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0) Oracle Retail Applications / RIB Kernal (Terracotta Quartz Scheduler) (15.0, 16.0) Oracle Retail Applications / Segment (Terracotta Quartz Scheduler) (18.0) Oracle Retail Applications / Xenvironment (Terracotta Quartz Scheduler) (15.0, 16.0, 17.0, 18.0, 19.0) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Construction and Engineering / Infrastructure (Quartz) (16.1, 16.2, 17.7 - 17.12, 18.8) Oracle Financial Services Applications / Core (Quartz) (2.7.0, 2.8.0) Oracle Financial Services Applications / Core (Quartz) (2.7.0, 2.8.0) Oracle Fusion Middleware / Install (Quartz) (12.2.1.3.0) Oracle Retail Applications / Order Broker Foundation (Apache Quartz) (15.0, 16.0, 18.0, 19.0) Oracle Retail Applications / Security (Apache Quartz) (14.1) Oracle Retail Applications / Security (Apache Quartz) (14.1) Oracle Retail Applications / Security (Apache Quartz) (14.1) Oracle Retail Applications / Security (Apache Quartz) (14.1) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Framework (Quartz) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Communications | Core (Quartz Scheduler) | 8.2.0-8.2.2 | |
| Oracle Communications Applications | Netwok Processor Configuration Management (Terracotta Quartz Scheduler) | 7.3.0, 7.4.0 | 7.3.0 · 7.4.0 |
| Oracle Construction and Engineering | Infrastructure (Quartz) | 16.1, 16.2, 17.7 - 17.12, 18.8 | 16.1 · 16.2 · 18.8 |
| Oracle Database Server | MapViewer (Terracotta Quartz Scheduler, Apache Batik, Google Guava) | 12.2.0.1, 18c, 19c | 12.2.0.1 · 18 · 19 |
| Oracle Enterprise Manager | Agent Provisioning (Quartz Scheduler) | 12.4.0.0 | 12.4.0.0 |
| Oracle Enterprise Manager | Connector Framework (Quartz) | 13.2.1.0 | 13.2.1.0 |
| Oracle Financial Services Applications | Core (Quartz) | 2.7.0, 2.8.0 | 2.7.0 · 2.8.0 |
| Oracle Financial Services Applications | Core (Terracotta Quartz Scheduler) | 14.1.0-14.4.0 | 12.0.0 · 12.1.0 |
| Oracle Financial Services Applications | Infrastructure (Terracotta Quartz Scheduler) | 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0 | 12.1.0 · 12.3.0 · 12.4.0 · 14.0.0 · 14.1.0 |
| Oracle Fusion Middleware | Directory Integration Platform (Quartz) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Install (Quartz) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle Fusion Middleware | Third Party (Quartz) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | WebCenter Sites (Terracotta Quartz Scheduler) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Hyperion | Common Security (Quartz) | 11.1.2.4 | 11.1.2.4 |
| Oracle Insurance Applications | Development tools (Terracotta Quartz Scheduler) | 12.6.0 - 12.6.4 | |
| Oracle JD Edwards | E1 IOT Orchestrator Security (Quartz) | 9.2.5.3 and Prior | |
| Oracle Retail Applications | Order Broker Foundation (Apache Quartz) | 15.0, 16.0, 18.0, 19.0 | 15.0 · 16.0 · 18.0 · 19.0 |
| Oracle Retail Applications | RIB Kernal (Terracotta Quartz Scheduler) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | Security (Apache Quartz) | 14.1 | 14.1 |
| Oracle Retail Applications | Segment (Terracotta Quartz Scheduler) | 18.0 | 18.0 |
| Oracle Retail Applications | Xenvironment (Terracotta Quartz Scheduler) | 15.0, 16.0, 17.0, 18.0, 19.0 | 15.0 · 16.0 · 17.0 · 18.0 · 19.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.quartz-scheduler:quartz |
0 | 2.3.2 |
unbounded |
Products and versions
32 products, 118 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomee | generic | 7.1.3 |
| nvd | atlassian | jira service management | generic | 4.20.0 · 4.20.1 · 4.20.2 · 4.20.3 · 4.20.4 · 4.20.5 · 4.20.6 · 4.20.7 · 4.20.8 · 4.20.9 · 4.20.10 · 4.20.11 · 4.20.12 · 4.20.13 · 4.20.14 · 4.20.15 · 4.20.16 · 4.20.17 · 4.20.18 · 4.20.19 · 4.20.20 · 4.20.21 · 4.20.22 · 4.20.23 · 4.20.24 · 4.20.25 · 4.21.0 · 4.21.1 · 4.22.0 · 4.22.1 · 4.22.2 · 4.22.3 · 4.22.4 · 4.22.6 · 5.0.0 · 5.1.0 · 5.1.1 · 5.2.0 · 5.2.1 · 5.3.0 · 5.3.1 · 5.3.2 · 5.3.3 · 5.4.0 · 5.4.1 · 5.4.2 · 5.4.3 · 5.4.4 · 5.4.5 · 5.4.6 · 5.4.7 · 5.4.8 · 5.4.9 · 5.5.1 · 5.6.0 · 5.7.0 · 5.7.1 · 5.8.0 · 5.8.1 · 5.9.0 · 5.10.0 |
| nvd | netapp | active iq unified manager | generic | any version |
| nvd | netapp | cloud secure agent | generic | any version |
| nvd | oracle | apache batik mapviewer | generic | 12.2.0.1 · 18c · 19c |
| nvd | oracle | banking enterprise originations | generic | 2.7.0 · 2.8.0 |
| nvd | oracle | banking enterprise product manufacturing | generic | 2.7.0 · 2.8.0 |
| nvd | oracle | banking payments | generic | ≥ 14.1.0 and ≤ 14.4.0 |
| nvd | oracle | communications ip service activator | generic | 7.3.0 · 7.4.0 |
| nvd | oracle | communications session route manager | generic | ≥ 8.2.0 and ≤ 8.2.2 |
| nvd | oracle | customer management and segmentation foundation | generic | 18.0 |
| nvd | oracle | documaker | generic | ≥ 12.6.0 and ≤ 12.6.4 |
| nvd | oracle | enterprise manager base platform | generic | 13.2.1.0 |
| nvd | oracle | enterprise manager ops center | generic | 12.4.0.0 |
| nvd | oracle | flexcube investor servicing | generic | 12.1.0 · 12.3.0 · 12.4.0 · 14.1.0 · 14.4.0 |
| nvd | oracle | flexcube private banking | generic | 12.0.0 · 12.1.0 |
| nvd | oracle | fusion middleware mapviewer | generic | 12.2.1.3.0 |
| nvd | oracle | google guava mapviewer | generic | 12.2.0.1 · 18c · 19c |
| nvd | oracle | hyperion infrastructure technology | generic | 11.1.2.4 |
| nvd | oracle | jd edwards enterpriseone orchestrator | generic | ≤ 9.2.5.3 |
| nvd | oracle | primavera unifier | generic | 16.1 · 16.2 · ≥ 17.7 and ≤ 17.12 · 18.8 |
| nvd | oracle | retail back office | generic | 14.1 |
| nvd | oracle | retail central office | generic | 14.1 |
| nvd | oracle | retail integration bus | generic | 15.0 · 16.0 |
| nvd | oracle | retail order broker | generic | 15.0 · 16.0 · 18.0 · 19.0 |
| nvd | oracle | retail point-of-service | generic | 14.1 |
| nvd | oracle | retail returns management | generic | 14.1 |
| nvd | oracle | retail xstore point of service | generic | 15.0 · 16.0 · 17.0 · 18.0 · 19.0 |
| nvd | oracle | terracotta quartz scheduler mapviewer | generic | 12.2.0.1 · 18c · 19c |
| nvd | oracle | webcenter sites | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| osv | org.quartz-scheduler | quartz | generic | ＜ 2.3.2 |
| nvd | softwareag | quartz | generic | ＜ 2.3.2 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, LOCAL LOGON, XENVIRONMENT (TERRACOTTA QUARTZ SCHEDULER), AGENT PROVISIONING (QUARTZ SCHEDULER), CORE (TERRACOTTA QUARTZ SCHEDULER), NO AUTH REMOTE EXPLOIT, SEE NOTE 2, SECURITY (APACHE QUARTZ), INFRASTRUCTURE (QUARTZ), RIB KERNAL (TERRACOTTA QUARTZ SCHEDULER), E1 IOT ORCHESTRATOR SECURITY (QUARTZ), CONNECTOR FRAMEWORK (QUARTZ), COMMON SECURITY (QUARTZ), SEGMENT (TERRACOTTA QUARTZ SCHEDULER), ORDER BROKER FOUNDATION (APACHE QUARTZ), CORE (QUARTZ), NETWOK PROCESSOR CONFIGURATION MANAGEMENT (TERRACOTTA QUARTZ SCHEDULER), INSTALL (QUARTZ), CORE (QUARTZ SCHEDULER), INFRASTRUCTURE (TERRACOTTA QUARTZ SCHEDULER), WEBCENTER SITES (TERRACOTTA QUARTZ SCHEDULER), DEVELOPMENT TOOLS (TERRACOTTA QUARTZ SCHEDULER) **Products:** PRIMAVERA UNIFIER, ORACLE COMMUNICATIONS SESSION ROUTE MANAGER, ORACLE ENTERPRISE MANAGER, ORACLE BANKING PAYMENTS, HYPERION INFRASTRUCTURE TECHNOLOGY, ORACLE RETAIL POINT-OF-SERVICE, ORACLE BANKING ENTERPRISE PRODUCT MANUFACTURING, ORACLE RETAIL RETURNS MANAGEMENT, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE COMMUNICATIONS IP SERVICE ACTIVATOR, ORACLE RETAIL APPLICATIONS, ORACLE RETAIL BACK OFFICE, GOOGLE GUAVA), ENTERPRISE MANAGER OPS CENTER, ENTERPRISE MANAGER BASE PLATFORM, ORACLE CONSTRUCTION AND ENGINEERING, CUSTOMER MANAGEMENT AND SEGMENTATION FOUNDATION, ORACLE JD EDWARDS, LIBQUARTZ, ORACLE BANKING ENTERPRISE ORIGINATIONS, ORACLE FLEXCUBE PRIVATE BANKING, ORACLE FLEXCUBE INVESTOR SERVICING, MAPVIEWER (TERRACOTTA QUARTZ SCHEDULER, ORACLE FUSION MIDDLEWARE, ORACLE RETAIL INTEGRATION BUS, ORACLE RETAIL XSTORE POINT OF SERVICE, ORACLE RETAIL CENTRAL OFFICE, ORACLE COMMUNICATIONS, ORACLE DATABASE SERVER, ORACLE RETAIL ORDER BROKER, ORACLE HYPERION, ORACLE FUSION MIDDLEWARE MAPVIEWER, ORACLE COMMUNICATIONS APPLICATIONS, APACHE BATIK, JD EDWARDS ENTERPRISEONE ORCHESTRATOR, ORACLE WEBCENTER SITES, ORACLE INSURANCE APPLICATIONS, ORACLE DOCUMAKER
References
Timeline
Timeline
| Published | 2019-07-26 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |