CVE-2020-10099: 
NixOS vulnerability analysis and mitigation

A persistent Cross-Site Scripting (XSS) vulnerability was discovered in Zammad versions 1.0.x through 3.2.0, identified as CVE-2020-10099. The vulnerability was disclosed on March 3, 2020, affecting the Ticket functionality in Zammad's helpdesk system (Zammad Advisory).

The vulnerability allows malicious code injection through the Ticket functionality by low-privileged users. When exploited, the malicious JavaScript executes within the browser of any user who opens the affected ticket or has the ticket within the Toolbar feature (Debian Tracker, Zammad Advisory).

The vulnerability enables persistent cross-site scripting attacks where malicious JavaScript code can be executed in the context of other users' browsers, including administrators, who access the affected ticket or have it in their Toolbar. This could potentially lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim (Zammad Advisory).

The vulnerability was patched in Zammad versions 3.2.1 and 3.3.0. Users are strongly recommended to upgrade to these or later versions. The fixes are available through the official Zammad website, FTP server, or through OS package managers (Zammad Advisory).