CVE-2021-43978: 
NixOS vulnerability analysis and mitigation

Allegro Windows (formerly known as Popsy Windows) version 3.3.4152.0 and earlier versions contain a vulnerability where software administrator database credentials are embedded into binary files. This vulnerability was discovered on August 19, 2021, and was assigned CVE-2021-43978. The issue affects the database access functionality of the application (Excellium Services).

The vulnerability stems from the application embedding database credentials of a software administrator user directly into its binary files. This implies that all instances of the software use the same credentials. The vulnerability has been assigned a CVSS v3.1 score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) (Excellium Services).

The vulnerability allows users to access and modify data using the embedded administrator credentials. Users can perform read, update, and delete operations on a large amount of data in the database, effectively having the same level of access as a software administrator (NVD, Excellium Services).

The vulnerability has been patched in Allegro Windows version 3.3.4156.1. Users are advised to upgrade to this version or later to address the security issue (Excellium Services).