-
Bug
-
Resolution: Fixed
-
Low
-
7.13.1
-
1
-
Severity 2 - Major
-
0
-
Issue Summary
Confluence is currently using underscore.js 1.10.2. However, it is being affected due to CVE-2021-23358
The package underscore from 1.13.0-0 and before 1.13.0-2
From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Steps to Reproduce
- Install Confluence 7.13.1 or below
Expected Results
Have Confluence using underscore.js 1.13.1 or higher.
Actual Results
Confluence is using underscore.js 1.10.2 which is affected.
Workaround
Currently there is no known workaround for this behavior. A workaround will be added here when available
- relates to
-
JRASERVER-72474 CVE-2021-23358 - Need to upgrade Underscore.js to 1.13.1 or higher
- Closed
-
JRASERVER-72643 Vulnerable version of Underscore.js used - CVE-2021-23358
- Published
- was cloned as
-
CONFSERVER-79462 UPM: upgrade Underscore.js to 1.13.1 or higher
- Closed
- links to