Upstream information

CVE-2021-23358 at MITRE

Description

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores
CVSS detail National Vulnerability Database
Base Score 6.5
Vector AV:N/AC:L/Au:S/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication Single
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
CVSS v3 Scores
CVSS detail CNA (Snyk) National Vulnerability Database
Base Score 3.3 7.2
Vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network Network
Attack Complexity High Low
Privileges Required High High
User Interaction None None
Scope Unchanged Unchanged
Confidentiality Impact Low High
Integrity Impact Low High
Availability Impact None High
CVSSv3 Version 3.1 3.1
SUSE Bugzilla entry: 1184800 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Leap 15.2
  • nodejs-underscore >= 1.13.1-lp152.4.3.1
 Patchnames:
openSUSE-2021-601
openSUSE Tumbleweed
  • nodejs-underscore >= 1.13.1-1.3
 Patchnames:
openSUSE-Tumbleweed-2024-11095

SUSE Timeline for this CVE

CVE page created: Mon Mar 29 20:43:51 2021
CVE page last modified: Fri Nov 7 11:50:47 2025