CVE-2020-14213: 
NixOS vulnerability analysis and mitigation

In Zammad versions 1.0.x up to 3.3.0, a vulnerability was discovered where a Customer had access to ticket information that should only be available to an Agent. The vulnerability, identified as CVE-2020-14213, was disclosed on June 15, 2020, and affected the ticket management system's authorization controls (Zammad Advisory).

The vulnerability stems from insufficient authorization checks in the ticket controller actions. The affected functionalities include ticket_customer, ticket_history, ticket_related, ticket_recent, ticket_merge, and ticket_split operations. This authorization bypass issue allowed customers to access internal data and perform agent-level operations (GitHub Commit).

The vulnerability allowed customer-level users to access internal ticket information, view ticket history, access related tickets, view recent tickets, and perform ticket merge and split operations that should be restricted to agent-level users only (Zammad Advisory).

An attacker only needed customer-level permissions to exploit this vulnerability. The attack could be performed by accessing specific API endpoints that should have been restricted to agent users (Zammad Advisory).

The vulnerability was fixed in Zammad versions 3.3.1 and 3.4.0. Users are recommended to upgrade to these or later versions. The fix can be obtained through the official Zammad website, FTP server, or via OS package manager updates (Zammad Advisory).