XXE in Apache Tomee
CVE-2019-13990
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.166 (97.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.162 · newest: 0.166 · change: +0.004
Affected products
- Apache Tomee — versions 7.1.3
- Atlassian Jira Service Management — versions 4.20.0, 4.20.1, 4.20.2
- NetApp Active Iq Unified Manager
- NetApp Cloud Secure Agent
- Oracle Apache Batik Mapviewer — versions 12.2.0.1, 18c, 19c
- Oracle Banking Enterprise Originations — versions 2.7.0, 2.8.0
- Oracle Banking Enterprise Product Manufacturing — versions 2.7.0, 2.8.0
- Oracle Banking Payments
- Oracle Communications Ip Service Activator — versions 7.3.0, 7.4.0
- Oracle Communications Session Route Manager
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e5… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc68… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e9755… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e7327567… (mailing-list, Patch)
- lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e8… (mailing-list, Third Party Advisory)
- www.oracle.com/security-alerts/cpuapr2020.html (Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2020.html (Third Party Advisory)
- github.com/quartz-scheduler/quartz/issues/467 (Third Party Advisory, Issue Tracking)
- lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce9… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f78495… (mailing-list, Issue Tracking)
Frequently asked questions
- What is CVE-2019-13990?
- CVE-2019-13990 is a critical-severity vulnerability in Apache Tomee, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2019-07-26.
- How severe is CVE-2019-13990?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-13990 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.