CVE-2021-23358 @ Npm-underscore-1.10.2

[AASMACMX]

Vulnerable Package issue exists @ Npm-underscore-1.10.2 in branch main

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Namespace: CxDemoInABoxRepos
Repository: Java-Webgoat
Repository Url: https://github.com/CxDemoInABoxRepos/Java-Webgoat
CxAST-Project: CxDemoInABoxRepos/Java-Webgoat
CxAST platform scan: 54f047f8-7049-4205-83b9-9e21c75dc4c9
Branch: main
Application: Java-Webgoat
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-94

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 1.12.1

---

References
Advisory
Issue
Pull request
Release Note
Commit