NetSight
IP …
critical9.8

CVE-2019-13990

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Impact

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Affected products

VendorProductAffected versions
SoftwareagQuartz
before 2.3.2
OracleApache Batik Mapviewer
Versions 12.2.0.1, 18c, 19c
OracleBanking Enterprise Originations
Versions 2.7.0, 2.8.0
OracleBanking Enterprise Product Manufacturing
Versions 2.7.0, 2.8.0
OracleBanking Payments
from 14.1.0 through 14.4.0
OracleCommunications Ip Service Activator
Versions 7.3.0, 7.4.0
OracleCommunications Session Route Manager
from 8.2.0 through 8.2.2
OracleCustomer Management And Segmentation Foundation
Version 18.0
OracleDocumaker
from 12.6.0 through 12.6.4
OracleEnterprise Manager Base Platform
Version 13.2.1.0
OracleEnterprise Manager Ops Center
Version 12.4.0.0
OracleFlexcube Investor Servicing
Versions 12.1.0, 12.3.0, 12.4.0, 14.1.0, 14.4.0

Weakness classification

CWE-611

References