Improper Certificate Validation in node-sass - CVE-2020-24025

Vulnerability identifier: #VU61501

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-24025

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to certificate validation is disabled when requesting binaries even if the user is not specifying an alternative download path. A remote attacker can perform MitM attack and compromise the affected application.

node-sass
eZ Platform
IBM Edge Application Manager
IBM Planning Analytics Workspace
QRadar Deployment Intelligence App
IBM Watson Machine Learning on CP4D
QRadar User Behavior Analytics

Install updates from vendor's website.

node-sass - update to 5.0.0
eZ Platform - update to 2.5.28
IBM Planning Analytics Workspace - update to 2.0.93
IBM Watson Machine Learning on CP4D - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.5
QRadar User Behavior Analytics - update to 4.1.11

• https://github.com/sass/node-sass/pull/567#issuecomment-656609236
• https://github.com/advisories/GHSA-r8f7-9pfq-mjmv

• MitM attack in node-sass
• eZ Platform update for node-sass
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App