The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer runs with SYSTEM privileges and follows these links, a user can cause the installer to delete files otherwise not deletable by the user.
Zoom implemented a fix for this issue in the Zoom IT installer for Windows version 4.6.10 published on April 7, 2020.
CVSS v3.0 Severity and Metrics
Base Score: 8.4 (High Severity)
Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Vector String: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Note: CVSS score may differ from that published in NVD due to differences between analysts in impact assessment or other calculation components.