At Zoom, we are hard at work to provide you with the best 24x7 global support experience. As part of this ongoing commitment, please review our updated Support Guidelines.

Security: CVE-2020-11443 Follow

The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer runs with SYSTEM privileges and follows these links, a user can cause the installer to delete files otherwise not deletable by the user.

Zoom implemented a fix for this issue in the Zoom IT installer for Windows version 4.6.10 published on April 7, 2020.

CVSS v3.0 Severity and Metrics

Base Score: 8.4 (High Severity)
Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: High
Availability: High
Vector String: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Note: CVSS score may differ from that published in NVD due to differences between analysts in impact assessment or other calculation components.