CVE-2019-13990

EPSS 16.2%
Veröffentlicht 26.07.2019 19:15:11
Zuletzt bearbeitet 21.11.2024 04:25:50
Erkennungen
Login

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 20

NVD 180 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Softwareag ≫ Quartz Version < 2.3.2

Oracle ≫ Apache Batik Mapviewer Version 12.2.0.1

Oracle ≫ Apache Batik Mapviewer Version 18c

Oracle ≫ Apache Batik Mapviewer Version 19c

Oracle ≫ Banking Enterprise Originations Version 2.7.0

Oracle ≫ Banking Enterprise Originations Version 2.8.0

Oracle ≫ Banking Enterprise Product Manufacturing Version 2.7.0

Oracle ≫ Banking Enterprise Product Manufacturing Version 2.8.0

Oracle ≫ Banking Payments Version >= 14.1.0 <= 14.4.0

Oracle ≫ Communications Ip Service Activator Version 7.3.0

Oracle ≫ Communications Ip Service Activator Version 7.4.0

Oracle ≫ Communications Session Route Manager Version >= 8.2.0 <= 8.2.2

Oracle ≫ Customer Management And Segmentation Foundation Version 18.0

Oracle ≫ Documaker Version >= 12.6.0 <= 12.6.4

Oracle ≫ Enterprise Manager Base Platform Version 13.2.1.0

Oracle ≫ Enterprise Manager Ops Center Version 12.4.0.0

Oracle ≫ Flexcube Investor Servicing Version 12.1.0

Oracle ≫ Flexcube Investor Servicing Version 12.3.0

Oracle ≫ Flexcube Investor Servicing Version 12.4.0

Oracle ≫ Flexcube Investor Servicing Version 14.1.0

Oracle ≫ Flexcube Investor Servicing Version 14.4.0

Oracle ≫ Flexcube Private Banking Version 12.0.0

Oracle ≫ Flexcube Private Banking Version 12.1.0

Oracle ≫ Fusion Middleware Mapviewer Version 12.2.1.3.0

Oracle ≫ Google Guava Mapviewer Version 12.2.0.1

Oracle ≫ Google Guava Mapviewer Version 18c

Oracle ≫ Google Guava Mapviewer Version 19c

Oracle ≫ Hyperion Infrastructure Technology Version 11.1.2.4

Oracle ≫ Jd Edwards Enterpriseone Orchestrator Version <= 9.2.5.3

Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12

Oracle ≫ Primavera Unifier Version 16.1

Oracle ≫ Primavera Unifier Version 16.2

Oracle ≫ Primavera Unifier Version 18.8

Oracle ≫ Retail Back Office Version 14.1

Oracle ≫ Retail Central Office Version 14.1

Oracle ≫ Retail Integration Bus Version 15.0

Oracle ≫ Retail Integration Bus Version 16.0

Oracle ≫ Retail Order Broker Version 15.0

Oracle ≫ Retail Order Broker Version 16.0

Oracle ≫ Retail Order Broker Version 18.0

Oracle ≫ Retail Order Broker Version 19.0

Oracle ≫ Retail Point-of-service Version 14.1

Oracle ≫ Retail Returns Management Version 14.1

Oracle ≫ Retail Xstore Point Of Service Version 15.0

Oracle ≫ Retail Xstore Point Of Service Version 16.0

Oracle ≫ Retail Xstore Point Of Service Version 17.0

Oracle ≫ Retail Xstore Point Of Service Version 18.0

Oracle ≫ Retail Xstore Point Of Service Version 19.0

Oracle ≫ Terracotta Quartz Scheduler Mapviewer Version 12.2.0.1

Oracle ≫ Terracotta Quartz Scheduler Mapviewer Version 18c

Oracle ≫ Terracotta Quartz Scheduler Mapviewer Version 19c

Oracle ≫ Webcenter Sites Version 12.2.1.3.0

Oracle ≫ Webcenter Sites Version 12.2.1.4.0

Apache ≫ Tomee Version 7.1.3

Netapp ≫ Active Iq Unified Manager Version - SwPlatform linux

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows

Netapp ≫ Cloud Secure Agent Version -

Atlassian ≫ Jira Service Management Version 4.20.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.0 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.1 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.2 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.2 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.3 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.3 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.4 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.4 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.5 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.5 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.6 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.6 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.7 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.7 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.8 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.8 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.9 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.9 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.10 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.10 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.11 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.11 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.12 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.12 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.13 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.13 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.14 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.14 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.15 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.15 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.16 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.16 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.17 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.17 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.18 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.18 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.19 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.19 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.20 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.20 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.21 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.21 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.22 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.22 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.23 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.23 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.24 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.24 SwEdition server

Atlassian ≫ Jira Service Management Version 4.20.25 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.20.25 SwEdition server

Atlassian ≫ Jira Service Management Version 4.21.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.21.0 SwEdition server

Atlassian ≫ Jira Service Management Version 4.21.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.21.1 SwEdition server

Atlassian ≫ Jira Service Management Version 4.22.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.22.0 SwEdition server

Atlassian ≫ Jira Service Management Version 4.22.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.22.1 SwEdition server

Atlassian ≫ Jira Service Management Version 4.22.2 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.22.2 SwEdition server

Atlassian ≫ Jira Service Management Version 4.22.3 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.22.3 SwEdition server

Atlassian ≫ Jira Service Management Version 4.22.4 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.22.4 SwEdition server

Atlassian ≫ Jira Service Management Version 4.22.6 SwEdition data_center

Atlassian ≫ Jira Service Management Version 4.22.6 SwEdition server

Atlassian ≫ Jira Service Management Version 5.0.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.0.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.1.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.1.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.1.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.1.1 SwEdition server

Atlassian ≫ Jira Service Management Version 5.2.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.2.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.2.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.2.1 SwEdition server

Atlassian ≫ Jira Service Management Version 5.3.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.3.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.3.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.3.1 SwEdition server

Atlassian ≫ Jira Service Management Version 5.3.2 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.3.2 SwEdition server

Atlassian ≫ Jira Service Management Version 5.3.3 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.3.3 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.1 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.2 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.2 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.3 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.3 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.4 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.4 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.5 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.5 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.6 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.6 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.7 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.7 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.8 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.8 SwEdition server

Atlassian ≫ Jira Service Management Version 5.4.9 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.4.9 SwEdition server

Atlassian ≫ Jira Service Management Version 5.5.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.5.1 SwEdition server

Atlassian ≫ Jira Service Management Version 5.6.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.6.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.7.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.7.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.7.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.7.1 SwEdition server

Atlassian ≫ Jira Service Management Version 5.8.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.8.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.8.1 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.8.1 SwEdition server

Atlassian ≫ Jira Service Management Version 5.9.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.9.0 SwEdition server

Atlassian ≫ Jira Service Management Version 5.10.0 SwEdition data_center

Atlassian ≫ Jira Service Management Version 5.10.0 SwEdition server

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	16.2%	0.965

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
CISA-ADP	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://www.oracle.com/security-alerts/cpujan2021.html

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Third Party Advisory

https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html

Third Party Advisory

https://github.com/quartz-scheduler/quartz/issues/467

Third Party Advisory

Issue Tracking

https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E

Third Party Advisory

https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E

Issue Tracking

https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E

Issue Tracking

https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E

Issue Tracking

https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf%40%3Ccommits.tomee.apache.org%3E

Patch

https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a%40%3Ccommits.tomee.apache.org%3E

Patch

https://lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f784950bf44cf%40%3Ccommits.tomee.apache.org%3E

Issue Tracking

https://lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce923bf8aa%40%3Ccommits.tomee.apache.org%3E

Issue Tracking

https://security.netapp.com/advisory/ntap-20221028-0002/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-13990

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-13990

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-13990

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-13990