Security readout for executives and security teams
Plain-English summary
This flaw lets malicious script in an HTML email run when a Webmin or Usermin user reads it in the Read Mail module. The main business risk is abuse of the logged-in user's browser session. The bundle provides no CVSS score, patch version, or evidence of active exploitation.
Executive priority
Treat this as a targeted session-risk issue for systems where administrators read mail through Webmin or Usermin. Prioritize inventory and vendor-guided upgrade, especially on internet-accessible management servers.
Technical view
CVE-2022-36880 is cross-site scripting in the Read Mail module of Webmin 1.995 and Usermin through 1.850 via a crafted HTML email message. The metadata does not include CWE, CVSS, exploit details, sanitizer root cause, or fixed release information.
Likely exposure
Exposure is likely where Webmin 1.995 or Usermin 1.850 or earlier is used for reading HTML email. Risk depends on whether users receive and open untrusted HTML email inside the Read Mail module.
Exploitation context
The source bundle does not show KEV listing or active exploitation. The described attack requires a crafted HTML email and a user viewing it in the affected Read Mail module.
Researcher notes
Evidence is limited to the CVE description and Webmin security reference. Do not assume affected CPEs, fixed versions, exploit availability, or exploitation in the wild without additional vendor or threat-intelligence confirmation.
Mitigation direction
- Check Webmin security guidance for the fixed release or vendor-recommended mitigation.
- Upgrade affected Webmin and Usermin installations when vendor guidance identifies a fixed version.
- Restrict Webmin/Usermin access to trusted administrators and networks where practical.
- Reduce exposure to untrusted HTML email in the affected Read Mail workflow.
Validation and detection
- Inventory Webmin and Usermin versions across managed hosts.
- Identify systems using the Read Mail module for HTML email viewing.
- Review vendor security notes for CVE-2022-36880 remediation details.
- Confirm no exposed installation is running Webmin 1.995 or Usermin through 1.850.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-36880 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.webmin.com/security.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.