# Information disclosure issue with ES 5.6.9

**URL:** <https://discuss.elastic.co/t/information-disclosure-issue-with-es-5-6-9/167900>\
**Category:** Elasticsearch\
**Created:** [February 11, 2019, 5:21pm UTC](https://discuss.elastic.co/t/information-disclosure-issue-with-es-5-6-9/167900 "2019-02-11T17:21:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sss/32/31486_2.png) [@sss](https://discuss.elastic.co/u/sss)\
**Post date:** [February 11, 2019, 5:21pm UTC](https://discuss.elastic.co/t/information-disclosure-issue-with-es-5-6-9/167900/1 "2019-02-11T17:21:03Z")

</div>

HI,

I have looked at the below post [ES vulnerability CVE-2018-3831](https://discuss.elastic.co/t/es-vulnerability-cve-2018-3831/153883) and it appears that X-pack is vulnerable since it stores secrets into cluster state ?  
Apart from x-Pack do what other standard ES plugins which suffer from this vulnerability ?

I am interested to know if any of the below plugins are vulnerable  
Netty4Plugin, ReIndexPlugin, DeleteByQuery Plugin and Painless Plugin.

I have 2 setups, one on ES 2.4.6 and other on ES 5.6.9

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 13, 2019, 2:30am UTC](https://discuss.elastic.co/t/information-disclosure-issue-with-es-5-6-9/167900/2 "2019-02-13T02:30:48Z")

</div>

> [@sss](#):
>
> it appears that X-pack is vulnerable since it stores secrets into cluster state

To be clear, that CVE is specifically about cluster _settings_ which are part of cluster state, but there are many things in cluster state that are not settings and are therefore not related to that CVE.

The 4 plugins that you mention by name are part of the standard Elasticsearch distribution, and are therefore covered in my reply on the referenced thread that the official distributions of Elasticsearch _without X-Pack installed_ do not stored any secrets in cluster settings.

If you have additional plugins, or if your distribution came from somewhere other than the official Elastic packages then we cannot make any guarantees about what is included.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2019, 2:31am UTC](https://discuss.elastic.co/t/information-disclosure-issue-with-es-5-6-9/167900/3 "2019-03-13T02:31:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.