CVE-2021-35303: 
NixOS vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was identified in Zammad versions 1.0.x through 4.0.0, tracked as CVE-2021-35303. The vulnerability was discovered in June 2021 and allows remote attackers to execute arbitrary web script or HTML through the User Avatar attribute (Zammad Advisory).

The vulnerability exists in Zammad's user avatar functionality, which allows users to upload their own avatars. When the avatar is converted into a displayable text value, the application fails to properly sanitize the input, allowing attackers to store malicious code in the User Avatar attribute. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, the stored malicious code is executed in the context of the current user's session whenever the compromised avatar is displayed. This can lead to the disclosure of sensitive information and potential manipulation of the web interface (Zammad Advisory).

The vulnerability requires no privileges to exploit, though user interaction is required. An attacker can trigger the execution of the malicious code by having a victim view a page where the compromised avatar is displayed (NVD).

The vulnerability has been fixed in Zammad versions 4.0.1 and 4.1.0. Users are recommended to upgrade to one of these fixed versions. Updates can be obtained through the official Zammad website, FTP server, or via OS package manager (Zammad Advisory).