CVE-2024-25957: 
NixOS vulnerability analysis and mitigation

Dell Grab for Windows, versions 5.0.4 and below, contains a cleartext storage of sensitive information vulnerability in its appsync module. This vulnerability was discovered and disclosed on March 26, 2024, affecting Dell Grab for Windows software (Dell Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.8 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) by Dell, while NIST assigned a score of 5.5 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File) (NVD).

An authenticated local attacker could potentially exploit this vulnerability, leading to information disclosure that could be used to access the appsync application with elevated privileges (Dell Advisory).

The vulnerability requires local access and low attack complexity. The attacker needs low privileges and user interaction is required to exploit the vulnerability (NVD).

Dell has released version 5.0.5 of Grab for Windows to address this vulnerability. Users are advised to upgrade to this version. No other workarounds have been provided (Dell Advisory).