Technical impact
Password Pusher includes a generic JSON API create path at /p.json that permits file-type push creation. Prior to versions 1.69.3 and 2.4.2, this endpoint could be accessed without authentication under certain configurations, allowing an attacker to upload files or push sensitive information without credentials, violating the intended authentication boundary. The flaw results in a CWE-288 authentication bypass, giving unauthorized access to data storage features.
Affected Systems
The affected vendor is pglombardo, product PasswordPusher. Versions older than 1.69.3 in the 1.x branch and older than 2.4.2 in the 2.x branch are vulnerable. Users running any prior release run the risk of unauthenticated file push creation.
Risk and Exploitability
The CVSS v3.1 score is 6.5, indicating moderate severity. The EPSS score is 0.00087, which is below 1%, suggesting a low but present probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires only access to the /p.json endpoint, the likely vector is remote via the web interface or API. An attacker who can reach the endpoint can create file pushes without authentication, potentially exposing sensitive data or facilitating further exploitation. No special privileges or complex prerequisites are required beyond normal network access to the application.
