CVE-2020-11443

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer runs with SYSTEM privileges and follows these links, a user can cause the installer to delete files that otherwise cannot be deleted by the user.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59 CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-WindowsBroken Link, Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451Broken Link, Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451-Security-CVE-2020-11443Broken Link, Vendor Advisory
https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-WindowsBroken Link, Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451Broken Link, Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451-Security-CVE-2020-11443Broken Link, Vendor Advisory

Timeline

Published: May 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-114448.8Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.CVE-2020-114455.3TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involv CVE-2020-114467.8ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET di CVE-2020-114474.3An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req CVE-2020-114486.1An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.CVE-2020-114497.5An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsett CVE-2020-11455.5An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allow CVE-2020-114507.5Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStr CVE-2020-114517.2The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files w CVE-2020-114524.3Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By p CVE-2020-114535.3Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStr CVE-2020-114545.4Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation o