Vulnerable version of Underscore.js

[Ajay Security]

Our app assessment team has found  vulnerable version of underscore.js but we have installed the latest package of  Atlassian Confluence 7.12.0.

Can we upgrade the out box of Underscore.js? 

Is Atlassian Confluence 7.12.0 uses Underscore.js.

Any help here is highly appreciated.

[Babu R]

@Ajay Security Did you get the solution ?? If yes, could you please share here ? 

[Brant Schroeder]

@Ajay Security Welcome to the Atlassian Community.  

I would suggest opening an issue with Atlassian support https://support.atlassian.com/contact/

They will be able to tell you if underscore.js is delivered or if it is part of an app you have installed.  You can also discuss the vulnerability with them in a private discussion instead of a public forum.