CVE-2020-11685: 
NixOS vulnerability analysis and mitigation

In JetBrains GoLand before version 2019.3.2, a security vulnerability was identified where the plugin repository was accessed via HTTP instead of HTTPS. This vulnerability was assigned CVE-2020-11685 and was disclosed on April 22, 2020. The issue affected JetBrains GoLand IDE installations prior to version 2019.3.2 (JetBrains Advisory).

The vulnerability is classified as a cleartext transmission of sensitive information (CWE-319). It received a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability is network-exploitable, requires low attack complexity, needs no privileges or user interaction, and could result in high confidentiality impact (NVD Database).

The use of HTTP instead of HTTPS for accessing the plugin repository could potentially expose sensitive information during transmission. This could allow attackers to intercept communications between the IDE and the plugin repository, potentially leading to information disclosure (NVD Database).

The vulnerability is considered to have low complexity for exploitation as it requires no special privileges or user interaction. The attack vector is network-based, making it remotely exploitable (NVD Database).

The vulnerability was fixed in JetBrains GoLand version 2019.3.2. Users should upgrade to this version or later to mitigate the security risk (JetBrains Advisory).