What are the security implications in disclosing the composer.lock file for a remote, public known, web application?

  • 1
    I think this falls under the same category of any disclosure of specific versions of software used on a server ... – schroeder Dec 5 '18 at 22:45

As composer can describe the

exact version numbers, and are useful to communicate the version you tested with to colleagues or when publishing an application

Reference #1

Revealing the version of the underlying library can be used against the application.

composer.lock file also ensures consistency across clusters of servers

It will ensure that all the servers behind a Load balance will be evenly vulnerable which will make the exploit more stable against a target.

Reference #2

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.