CVE-2019-13990

highpriority · attend · 55EPSS 0.166 · 97 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

16.6% (97th) EPSS

CVSS 7.5 · high

Is it mine?

174 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-611USprimaryCWE-611USCWE-611US

exploits (1)

Public proof-of-concept and weaponised exploit code.

epicosy/Quartz-1quartz with CVE-2019-13990PoC · poc_in_github

affected products (174)

Products and version ranges known to be affected.

Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Atlassian Atlassian Bamboo Data Center LTS <10.2.22≤ Data Center LTS <10.2.22cert_bundDE
Atlassian Atlassian Bamboo Data Center LTS <12.1.10≤ Data Center LTS <12.1.10cert_bundDE
Atlassian Atlassian Bitbucket Data Center <10.4.2≤ Data Center <10.4.2cert_bundDE
Atlassian Atlassian Bitbucket Data Center LTS <10.2.6≤ Data Center LTS <10.2.6cert_bundDE
Atlassian Atlassian Bitbucket Data Center LTS <9.4.23≤ Data Center LTS <9.4.23cert_bundDE
Atlassian Atlassian Confluence Data Center LTS <10.2.15≤ Data Center LTS <10.2.15cert_bundDE
Atlassian Atlassian Confluence Data Center LTS <9.2.23≤ Data Center LTS <9.2.23cert_bundDE
Atlassian Atlassian Crucible <4.9.13< 4.9.13cert_bundDE
Atlassian Atlassian Fisheye <4.9.13< 4.9.13cert_bundDE
Atlassian Atlassian Jira Data Center LTS <10.3.24≤ Data Center LTS <10.3.24cert_bundDE
Atlassian Atlassian Jira Data Center LTS <11.3.10≤ Data Center LTS <11.3.10cert_bundDE
Atlassian Bamboo≤ Data Center LTS <12.1.10cert_bundDE
Atlassian Bamboo≤ Data Center LTS <10.2.22cert_bundDE
Atlassian Bitbucket≤ Data Center <10.4.2cert_bundDE
Atlassian Bitbucket≤ Data Center LTS <10.2.6cert_bundDE
Atlassian Bitbucket≤ Data Center LTS <9.4.23cert_bundDE
Atlassian Confluence≤ Data Center LTS <9.2.23cert_bundDE
Atlassian Confluence≤ Data Center LTS <10.2.15cert_bundDE
Atlassian Crucible< 4.9.13cert_bundDE

showing 20 of 174

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2700Atlassian Confluence: Mehrere SchwachstellenDeutsch2023-10-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Confluence, Atlassian Jira Software, Atlassian Bitbucket und Atlassian Bamboo ausnutzen, um Administratorrechte zu erlangen, Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2024-0899Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2024-04-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-1608Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere SchwachstellenDeutsch2026-05-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2026-2923Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
GHSA-9qcf-c26r-x5rfXML external entity injection in Terracotta Quartz Scheduler2020-07-01ghsa · osvUS
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2019-07-26modified 2026-06-17

related (1,520)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-58360US	critical9.8OT critical	61.2% (99th)	KEV	2025-11-25
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnera…
CVE-2025-2776US	critical9.8OT critical	64.7% (99th)	KEV	2025-05-07
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrat…
CVE-2025-2775US	high7.5OT critical	42.6% (99th)	KEV	2025-05-07
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator…
CVE-2024-34102US	—OT critical	100.0% (100th)	KEV	2024-06-13
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could re…
CVE-2023-45727US	high7.5OT critical	4.82% (92nd)	KEV	2023-10-18
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthent…

+1515 more

references (75)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan