CVE-2022-35490: 
NixOS vulnerability analysis and mitigation

Zammad 5.2.0 contains a critical vulnerability (CVE-2022-35490) related to privilege escalation through brute-force attack prevention bypass. The vulnerability was discovered and disclosed on July 5, 2022, affecting the authentication mechanism in Zammad's login system (Zammad Advisory, CVE Mitre).

The vulnerability exists in Zammad's brute-force attack prevention mechanism. After a configurable number of login attempts, the system is designed to invalidate users and prevent further login attempts. However, an attacker can bypass this prevention mechanism, allowing them to send more login requests than the configured limit before user invalidation takes effect (Zammad Advisory).

The vulnerability could allow attackers to perform unlimited login attempts, effectively bypassing the brute-force protection mechanism. This could potentially lead to unauthorized access to user accounts through credential guessing or brute-force attacks (CVE Mitre).

The vulnerability has been fixed in Zammad version 5.2.1. Users are strongly recommended to upgrade to this version. The fix can be obtained through the official Zammad website, FTP server, or through the OS package manager (Zammad Advisory).