# Elastic 6.6 Elasticsearch Unrestricted Access Information Disclosure **URL:** \ **Category:** Elasticsearch\ **Created:** [December 12, 2019, 7:12am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579 "2019-12-12T07:12:28Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![pugdummy](https://avatars.discourse-cdn.com/v4/letter/p/439d5e/32.png) [@pugdummy](https://discuss.elastic.co/u/pugdummy)\ **Post date:** [December 12, 2019, 7:12am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/1 "2019-12-12T07:12:28Z")
Hello, I'm new with Elastic and we are only using this on UiPath for monitoring. We recently got this vulnerability: Elasticsearch Unrestricted Access Information Disclosure Can anyone help me on what to do to fix this? Thanks! ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [December 12, 2019, 8:58am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/2 "2019-12-12T08:58:01Z")
Can you please create some more context where this message is coming from? I suppose you used some security scanner against Elasticsearch without securing it. You can check out the documentation [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/secure-cluster.html). ---
**Author:** ![pugdummy](https://avatars.discourse-cdn.com/v4/letter/p/439d5e/32.png) [@pugdummy](https://discuss.elastic.co/u/pugdummy)\ **Post date:** [December 12, 2019, 8:59am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/3 "2019-12-12T08:59:50Z")
Hi sorry about that. I think the reason why this vulnerability was found is because we do not use authentication for kibana and elastic. ---
**Author:** ![pugdummy](https://avatars.discourse-cdn.com/v4/letter/p/439d5e/32.png) [@pugdummy](https://discuss.elastic.co/u/pugdummy)\ **Post date:** [December 12, 2019, 9:01am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/4 "2019-12-12T09:01:55Z")
Does adding authentication and password for user on kibana available for the free version? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 12, 2019, 10:00am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/5 "2019-12-12T10:00:35Z")
Security is available with the basic license from version 6.8 onwards, so you will need to upgrade. ---
**Author:** ![pugdummy](https://avatars.discourse-cdn.com/v4/letter/p/439d5e/32.png) [@pugdummy](https://discuss.elastic.co/u/pugdummy)\ **Post date:** [December 12, 2019, 10:09am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/6 "2019-12-12T10:09:07Z")
> [@Christian\_Dahlqvist](#): > > Security is available with the basic license from version 6.8 onwards, so you will need to upgrade. Hi, we are using 6.6 at the moment. So the adding of password and user is not available for this version? Where can I see which version has this option? As of now UiPath last Elasticseach version they support is 6.6 so I'm hesitant to upgrade version thanks! ---
**Author:** ![pugdummy](https://avatars.discourse-cdn.com/v4/letter/p/439d5e/32.png) [@pugdummy](https://discuss.elastic.co/u/pugdummy)\ **Post date:** [December 12, 2019, 10:29am UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/7 "2019-12-12T10:29:54Z")
I saw that I need to enable `xpack.security.enabled` setting is `true` on elasticsearch.yml but i do not know how to do this. Is it okay to just edit the yml file via notepad? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 12, 2019, 1:37pm UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/8 "2019-12-12T13:37:30Z")
Yes, you can use an editor. If you are using 6.6 this will however require a commercial license. ---
**Author:** ![pugdummy](https://avatars.discourse-cdn.com/v4/letter/p/439d5e/32.png) [@pugdummy](https://discuss.elastic.co/u/pugdummy)\ **Post date:** [December 12, 2019, 2:06pm UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/9 "2019-12-12T14:06:22Z")
Thanks a lot Christian. I just checked and it seems UiPath supports 6.8 and 7x now. Do you think it's better to install 7x or 6.8 for the authentication? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 9, 2020, 2:06pm UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579/10 "2020-01-09T14:06:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.