CVE-2020-11443

Katalog CVE

CVSS 8.1 · High EPSS 1,5%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada zoom it installer. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer runs with SYSTEM privileges and follows these links, a user can cause the installer to delete files that otherwise cannot be deleted by the user.

Rincian

Terbit di NVD

4 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-Windows broken link · advisory vendor
• https://support.zoom.us/hc/en-us/articles/360043036451 broken link · advisory vendor
• https://support.zoom.us/hc/en-us/articles/360043036451-Security-CVE-2020-11443 broken link · advisory vendor