installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins

How it was found

kindly if you don't accept this issue please close it as informative , thanks in advance

Description:

The installed.json file is a sensitive file and it was publicly accessible on your webserver , which discloses some information about your web site and users such as authors like admin as shown below: "authors": [ { "name": "Modern Tribe", "email": "[email protected]" }

Steps to Produce:

1. Go to https://blog.yelp.com/vendor/composer/installed.json

References :

https://www.acunetix.com/vulnerabilities/web/composer-installed-json-publicly-accessible/ https://hackerone.com/reports/461598

Remediation:

Restrict Access to vendors directory

Impact

Disclosure of information about components used by the web application.