CVE-2020-10098: 
NixOS vulnerability analysis and mitigation

CVE-2020-10098 is a Persistent Cross-Site Scripting (XSS) vulnerability discovered in Zammad versions 1.0.x through 3.2.0. The vulnerability was disclosed on March 3, 2020, affecting the Email functionality of the Zammad ticketing system (Zammad Advisory).

The vulnerability allows malicious code to be injected through the Email functionality by a low-privileged user. When a ticket containing the malicious article created from that email is opened, the embedded JavaScript code executes within the browser of any user viewing the ticket (Zammad Advisory).

The vulnerability enables persistent cross-site scripting attacks where malicious JavaScript code can execute in the browsers of users who view affected tickets. This could potentially lead to session hijacking, data theft, or other malicious actions performed in the context of the victim's browser session (Zammad Advisory).

The vulnerability has been fixed in Zammad versions 3.2.1 and 3.3.0. Users are recommended to upgrade to these or later versions. Updates can be obtained through the official Zammad website, FTP server, or through OS package managers (Zammad Advisory).