# Elastic Search Unrestricted Information Disclosure Vulnerability

**URL:** <https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688>\
**Category:** Elasticsearch\
**Created:** [February 9, 2022, 7:17am UTC](https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688 "2022-02-09T07:17:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kshi](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kshi](https://discuss.elastic.co/u/kshi)\
**Post date:** [February 9, 2022, 7:17am UTC](https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688/1 "2022-02-09T07:17:23Z")

</div>

Hi Team,

We are using **Elasticsearch version 1.6.1** for one of our product Recovery Manger.  
Where it is just used for message finding and indexing.

Customer is using the **Nessus Vulnerability scanner** and is coming out with the finding **"Elasticsearch Unrestricted Information Disclosure Vulnerability"**.  
For reference Report url : [Elasticsearch Unrestricted Access Information Disclosure | Tenable®](https://www.tenable.com/plugins/nessus/101025)

Please let me know how we can resolve the vulnerability or any workaround.

It is in priority , Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 9, 2022, 7:18am UTC](https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688/2 "2022-02-09T07:18:39Z")

</div>

Welcome to our community! 😃

Elasticsearch 1.6 is no longer supported as it's well past it's [EOL](https://www.elastic.co/support/eol). You will need to upgrade.

---

<div class="post-metadata">

**Author:** ![kshi](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kshi](https://discuss.elastic.co/u/kshi)\
**Post date:** [February 9, 2022, 7:27am UTC](https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688/3 "2022-02-09T07:27:09Z")

</div>

Thanks for the response.

Which version is stable to use and easy to migrate from 1.6.1 ?

And which is not prone to the above mentioned vulnerability.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 9, 2022, 7:52am UTC](https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688/4 "2022-02-09T07:52:29Z")

</div>

The current version is 7.17, 8.0 is not far off being released.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 9, 2022, 9:53am UTC](https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688/5 "2022-02-09T09:53:16Z")

</div>

> [@kshi](#):
>
> easy to migrate from 1.6.1 ?

There is nothing easy as 1.6 is sooooo old.  
I'd consider reindexing the data if possible.  
You might want to try the reindex from remote feature. Not sure how it works with a 1.6 cluster though.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2022, 9:53am UTC](https://discuss.elastic.co/t/elastic-search-unrestricted-information-disclosure-vulnerability/296688/6 "2022-03-09T09:53:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.