CVE-2021-35299: 
NixOS vulnerability analysis and mitigation

Incorrect Access Control in Zammad versions 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. The vulnerability was discovered and disclosed on June 8, 2021, and was assigned CVE-2021-35299. The issue affects all Zammad installations from version 1.0.x through 4.0.0 (Vendor Advisory).

The vulnerability stems from Zammad's functionality to automatically probe email connection configurations. When a full probing (inbound and outbound) connection configuration was successful, the valid credentials were logged to the Zammad application log file. This implementation flaw could allow an attacker with access to the log file to obtain the credentials. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could lead to unauthorized disclosure of sensitive email connection credentials if an attacker gains access to the Zammad application log file. This exposure of credentials could potentially lead to unauthorized access to email systems and sensitive information (Vendor Advisory).

The vulnerability requires access to the Zammad application log file to exploit. Once an attacker has access to the logs, they can obtain valid email connection credentials that were logged during successful connection probing (Vendor Advisory).

The vulnerability has been fixed in Zammad versions 4.0.1 and 4.1.0. Users are recommended to upgrade to one of these fixed versions. Updates can be obtained from the official Zammad website, FTP server, or through the OS package manager (Vendor Advisory).