ZohoCorp ManageEngine Applications Manager versions 182000 and below contain an improper input validation vulnerability (CWE-20) that permits a low-privileged user to modify proxy settings. The CVSS 3.1 score is 8.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. No official patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.

An attacker with low privileges can change proxy settings, potentially redirecting traffic or intercepting communications, which compromises confidentiality and integrity of the system. Availability is not impacted. This could facilitate further attacks or data leakage if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict low-privileged user access to the application and monitor for unauthorized configuration changes.