CVE-2020-11443

Опубликовано: 04 мая 2020

Источник: nvd

CVSS3: 8.1

CVSS2: 8.5

EPSS Низкий

Описание

The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer runs with SYSTEM privileges and follows these links, a user can cause the installer to delete files that otherwise cannot be deleted by the user.

Ссылки

https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-Windows
Broken Link
Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451
Broken Link
Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451-Security-CVE-2020-11443
Broken Link
Vendor Advisory
https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-Windows
Broken Link
Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451
Broken Link
Vendor Advisory
https://support.zoom.us/hc/en-us/articles/360043036451-Security-CVE-2020-11443
Broken Link
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zoom:it_installer:*:*:*:*:*:windows:*:*

Версия до 4.6.10 (исключая)

EPSS

Процентиль: 63%

0.00443

Низкий

8.1 High

CVSS3

8.5 High

CVSS2

Дефекты

CWE-59

Связанные уязвимости

GHSA-wc6m-2q93-p5qr

github

больше 3 лет назад

The MSI installer in Zoom before 4.6.10 on Windows follows Symbolic Links.