CVE-2023-50453: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Zammad before 6.2.0. The application uses the public endpoint /api/v1/signshow for its login screen, which returns internal configuration data of user object attributes, such as selectable values, that should not be visible to the public (Vendor Advisory).

The vulnerability is related to information disclosure through the public API endpoint /api/v1/signshow. This endpoint, which is used for the login screen functionality, exposes internal configuration data about user object attributes including selectable values. The issue has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows unauthorized access to internal configuration data that should be restricted from public view. This could potentially provide attackers with insights into the system's internal structure and configuration (Vendor Advisory).

The vulnerability has been fixed in Zammad version 6.2.0. Users are recommended to upgrade to this version or later. The fix can be obtained through the official Zammad website, FTP server, or through the OS package manager (Vendor Advisory).