CVE-2019-13990: Apache Tomee

Critical severity, CVSS 9.8. EPSS: 16.2% chance of exploitation in the next 30 days.

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Affected products

  • Apache Tomee: version 7.1.3 only
  • Atlassian Jira Service Management: version 4.20.0 only; version 4.20.1 only; version 4.20.2 only; version 4.20.3 only; version 4.20.4 only; version 4.20.5 only; …
  • Netapp Active Iq Unified Manager: affected versions not specified
  • Netapp Cloud Secure Agent: affected versions not specified
  • Oracle Apache Batik Mapviewer: version 12.2.0.1 only; version 18c only; version 19c only
  • Oracle Banking Enterprise Originations: version 2.7.0 only; version 2.8.0 only
  • Oracle Banking Enterprise Product Manufacturing: version 2.7.0 only; version 2.8.0 only
  • Oracle Banking Payments: from 14.1.0, up to and including 14.4.0
  • Oracle Communications IP Service Activator: version 7.3.0 only; version 7.4.0 only
  • Oracle Communications Session Route Manager: from 8.2.0, up to and including 8.2.2
  • Oracle Customer Management And Segmentation Foundation: version 18.0 only
  • Oracle Documaker: from 12.6.0, up to and including 12.6.4
  • Oracle Enterprise Manager Base Platform: version 13.2.1.0 only
  • Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
  • Oracle Flexcube Investor Servicing: version 12.1.0 only; version 12.3.0 only; version 12.4.0 only; version 14.1.0 only; version 14.4.0 only
  • Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only
  • Oracle Fusion Middleware Mapviewer: version 12.2.1.3.0 only
  • Oracle Google Guava Mapviewer: version 12.2.0.1 only; version 18c only; version 19c only
  • Oracle Hyperion Infrastructure Technology: version 11.1.2.4 only
  • Oracle Jd Edwards Enterpriseone Orchestrator: up to and including 9.2.5.3
  • Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 16.1 only; version 16.2 only; version 18.8 only
  • Oracle Retail Back Office: version 14.1 only
  • Oracle Retail Central Office: version 14.1 only
  • Oracle Retail Integration Bus: version 15.0 only; version 16.0 only
  • Oracle Retail Order Broker: version 15.0 only; version 16.0 only; version 18.0 only; version 19.0 only
  • and 6 more

Published 2019-07-26. Last modified 2026-06-17.