CVE-2021-31898: 
NixOS vulnerability analysis and mitigation

In JetBrains WebStorm before version 2021.1, a security vulnerability was identified where HTTP requests were used instead of HTTPS. This vulnerability was assigned CVE-2021-31898 and was disclosed on May 11, 2021. The issue affected JetBrains WebStorm installations prior to version 2021.1 (JetBrains Bulletin).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information). The technical issue stems from the application using unsecured HTTP protocol instead of the encrypted HTTPS protocol for requests (NVD).

The use of HTTP instead of HTTPS could potentially expose sensitive information transmitted between the client and server to unauthorized interception, as the data is transmitted in cleartext. This vulnerability primarily affects the confidentiality of transmitted data, with high impact on confidentiality but no direct impact on integrity or availability (NVD).

The vulnerability was fixed in WebStorm version 2021.1. Users should upgrade to this version or later to mitigate the security risk. JetBrains has classified this as a Low severity issue in their security bulletin (JetBrains Bulletin).