Goland
CVE-2020-11685
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.
AnalysisAI
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-319. In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Affected products include: Jetbrains Goland. Version information: before 2019.3.2.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine w
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-contro
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1,
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentia
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today