Note: As our world comes together to slow the spread of COVID-19 pandemic, the Zoom Support Center has continued to operate 24x7 globally to support you. Please see the updated Support Guidelines during these unprecedented times.

Security: CVE-2020-11443 Follow

The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer runs with SYSTEM privileges and follows these links, a user can cause the installer to delete files otherwise not deletable by the user.

Zoom implemented a fix for this issue in the Zoom IT installer for Windows version 4.6.10 published on April 7, 2020.

CVSS v3.0 Severity and Metrics

Base Score: 8.4 (High Severity)
Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: High
Availability: High
Vector String: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Note: CVSS score may differ from that published in NVD due to differences between analysts in impact assessment or other calculation components.