CVE-2020-10102: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Zammad versions 3.0 through 3.2 (CVE-2020-10102), disclosed on March 3, 2020. The vulnerability affects the Forgot Password functionality, which allows anonymous users to enumerate valid user email accounts due to different system responses based on input validation (Zammad Advisory, NVD).

The vulnerability exists in the password reset mechanism where the application responds differently depending on whether the input supplied was recognized as associated with a valid user. This implementation flaw enables unauthorized users to determine which email addresses correspond to valid accounts in the system (Zammad Advisory).

The vulnerability enables a two-stage automated attack where attackers can first enumerate valid user accounts by iterating through email lists, and then potentially conduct brute force attacks against identified valid accounts using common password lists (Zammad Advisory).

The vulnerability has been fixed in Zammad versions 3.2.1 and 3.3.0. Users are recommended to upgrade to these or later versions. Updates can be obtained through the official Zammad website, FTP repository, or via OS package managers (Zammad Advisory).