# ES vulnerability CVE-2018-3831

**URL:** <https://discuss.elastic.co/t/es-vulnerability-cve-2018-3831/153883>\
**Category:** Elasticsearch\
**Created:** [October 24, 2018, 11:04pm UTC](https://discuss.elastic.co/t/es-vulnerability-cve-2018-3831/153883 "2018-10-24T23:04:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![naysw01](https://avatars.discourse-cdn.com/v4/letter/n/c5a1d2/32.png) [@naysw01](https://discuss.elastic.co/u/naysw01)\
**Post date:** [October 24, 2018, 11:04pm UTC](https://discuss.elastic.co/t/es-vulnerability-cve-2018-3831/153883/1 "2018-10-24T23:04:22Z")

</div>

Is CVE-2018-3831(Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API) applicable to standard elasticsearch or just elasticsearch with xpack plugin?  
Thanks!

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 25, 2018, 1:52am UTC](https://discuss.elastic.co/t/es-vulnerability-cve-2018-3831/153883/2 "2018-10-25T01:52:54Z")

</div>

The underlying issue with the `_cluster/settings` API affects standard elasticsearch, but the only secrets that are stored in dynamic cluster settings are part of x-pack, so there would be no information disclosure if x-pack isn't installed.

The issue could affect other plugins that store secrets in cluster settings.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2018, 2:04am UTC](https://discuss.elastic.co/t/es-vulnerability-cve-2018-3831/153883/3 "2018-11-22T02:04:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.