Add CVE-2021-21389 for GHSA-m6j4-8r7p-wpp3

2021/21xxx/CVE-2021-21389.json

@@ -1,18 +1,93 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security-advisories@github.com",
         "ID": "CVE-2021-21389",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC",
+        "TITLE": "BuddyPress privilege escalation via REST API"
     },
-    "description": {
-        "description_data": [
+    "affects": {
+        "vendor": {
+            "vendor_data": [
                 {
-                "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "BuddyPress",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": ">= 5.0.0, < 7.2.1"
                                         }
                                     ]
                                 }
                             }
+                        ]
+                    },
+                    "vendor_name": "buddypress"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
+    "description": {
+        "description_data": [
+            {
+                "lang": "eng",
+                "value": "BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint.\n\nThe vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue."
+            }
+        ]
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "NONE",
+            "baseScore": 8.1,
+            "baseSeverity": "HIGH",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "LOW",
+            "scope": "UNCHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-863: Incorrect Authorization "
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "name": "https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3",
+                "refsource": "CONFIRM",
+                "url": "https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3"
+            },
+            {
+                "name": "https://buddypress.org/2021/03/buddypress-7-2-1-security-release/",
+                "refsource": "MISC",
+                "url": "https://buddypress.org/2021/03/buddypress-7-2-1-security-release/"
+            },
+            {
+                "name": "https://codex.buddypress.org/releases/version-7-2-1/",
+                "refsource": "MISC",
+                "url": "https://codex.buddypress.org/releases/version-7-2-1/"
+            }
+        ]
+    },
+    "source": {
+        "advisory": "GHSA-m6j4-8r7p-wpp3",
+        "discovery": "UNKNOWN"
+    }
+}