CVE-2020-10097: 
NixOS vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-10097) was discovered in Zammad versions 3.0 through 3.2. The vulnerability allows the application to respond with verbose error messages that could disclose internal application or infrastructure information (Vendor Advisory, NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is related to the generation of error messages containing sensitive information, identified as CWE-209 (NVD).

When exploited, the vulnerability could allow attackers to gather internal application or infrastructure information through verbose error messages. This information could potentially be used to aid in successfully exploiting other vulnerabilities (Vendor Advisory).

The vulnerability is remotely exploitable without requiring authentication. The attack complexity is considered low, requiring no privileges or user interaction to exploit (NVD).

The vulnerability has been fixed in Zammad versions 3.2.1 and 3.3.0. Users are recommended to upgrade to these or later versions. The fix is available through the official website, FTP server, or through OS package managers (Vendor Advisory).