CVE-2021-23358 - Need to upgrade Underscore.js to 1.13.1 or higher

XMLWordPrintable

    • 1
    • Severity 2 - Major
    • 0

      Issue Summary

      Confluence is currently using underscore.js 1.10.2. However, it is being affected due to CVE-2021-23358

      The package underscore from 1.13.0-0 and before 1.13.0-2
      From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

      Steps to Reproduce

      1. Install Confluence 7.13.1 or below

      Expected Results

      Have Confluence using underscore.js 1.13.1 or higher.

      Actual Results

      Confluence is using underscore.js 1.10.2 which is affected.

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

            Assignee:
            Bhanu Darisi (Inactive)
            Reporter:
            Danny (Inactive)
            Votes:
            2 Vote for this issue
            Watchers:
            23 Start watching this issue

              Created:
              Updated:
              Resolved: