CVE-2019-13990

CRITICAL9.8EPSS 13.8%

XML external entity injection in Terracotta Quartz Scheduler

Published: 7/1/2020Modified: 4/28/2026
Also known as:DEBIAN-CVE-2019-13990

Description

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Affected packages (3)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (31)