installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins
Low
Y
Yelp
Submitted None
Actions:
Reported by
whitehacker18
Vulnerability Details
Technical details and impact analysis
##kindly if you don't accept this issue please close it as informative , thanks in advance
##Description:
The installed.json file is a sensitive file and it was publicly accessible on your webserver , which discloses some information about your web site and users such as authors like admin as shown below:
`"authors": [
{
"name": "Modern Tribe",
"email": "[email protected]"
}
`
##Steps to Produce:
1. Go to https://blog.yelp.com/vendor/composer/installed.json
##References :
https://www.acunetix.com/vulnerabilities/web/composer-installed-json-publicly-accessible/
https://hackerone.com/reports/461598
##Remediation:
Restrict Access to vendors directory
## Impact
Disclosure of information about components used by the web application.
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Information Disclosure