CVE-2020-10096: 
NixOS vulnerability analysis and mitigation

A vulnerability in Zammad versions 1.0.x up to 3.2.0 was identified where the application failed to prevent caching of confidential data within browser memory. The vulnerability, assigned CVE-2020-10096, was discovered and disclosed on March 3, 2020, affecting all Zammad installations prior to version 3.2.1 (Zammad Advisory).

The vulnerability stems from the application's failure to implement proper browser cache controls for sensitive information. This security flaw allows sensitive data to remain accessible in the browser's cache memory, potentially exposing confidential information to unauthorized access (Zammad Advisory).

The vulnerability enables attackers who gain either remote or physical access to a user's workstation to access sensitive information stored in the browser cache. Importantly, the attacker does not need to be authenticated with the application to view this cached information (Zammad Advisory).

The vulnerability has been fixed in Zammad versions 3.2.1 and 3.3.0. Users are recommended to upgrade to these or later versions to address the security issue. Updates can be obtained through the official Zammad website, FTP server, or through OS package managers (Zammad Advisory).