CVE-2021-28681: webrtc_project webrtc Incorrect Authorization

Vulnerability summary

CVE-2021-28681 is a medium (CVSS 5.3) Incorrect Authorization vulnerability in webrtc_project webrtc. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-03-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.