Critical XXE Vulnerability in libquartz-java: CVE-2019-13990
Summary
UBUNTU-CVE-2019-13990: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Affects libquartz-java versions 1:1.7.3-5 – 1:1.8.6-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libquartz-java is a Java library that provides scheduling capabilities for Java applications, allowing developers to execute tasks at specified times or intervals. It is widely used in enterprise applications for job scheduling. However, it has been found to be vulnerable to XML External Entity (XXE) attacks, which can lead to serious security breaches if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2019-13990, originates from the initDocumentParser method in the XMLSchedulingDataProcessor.java file of the Terracotta Quartz Scheduler up to version 2.3.0. This flaw allows attackers to perform XXE attacks via a job description, potentially leading to unauthorized access to sensitive data, server-side request forgery (SSRF), and other severe impacts. The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to disable XML parsing features in the application if possible, or to validate and sanitize all XML input to prevent XXE attacks.
Conclusion
The CVE-2019-13990 vulnerability in libquartz-java poses a significant risk due to its potential for XXE attacks. It is crucial for users of this library to update to the latest patched version to safeguard their applications. Implementing additional security measures, such as input validation, can further mitigate risks.
See every vulnerability recorded for libquartz-java →
FAQ
CVE-2019-13990 is a critical vulnerability in the libquartz-java library that allows for XML External Entity (XXE) attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, server-side request forgery, and other severe security breaches.
If immediate updates are not possible, consider implementing input validation and sanitization to mitigate the risk of XXE attacks.
Yes, a patched version of libquartz-java is available. Ensure to update to version 1:1.8.6-8 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for libquartz-java.
