ElasticSearch port 9200 open to everyone. Is it wrong?

I have Elasticsearch running with a PHP-Symfony app, and a mysql DB. Everything is working fine, but I just have one concern, not sure if this is critical or not. Hope community will help.

If I'm trying to access my server IP on port 9200 like this:

http://[serverIP]:9200

I have a JSON / Object output:

{
  "status" : 200,
  "name" : "Cutthroat",
  "cluster_name" : "elasticsearch",
  "version" : {
    "number" : "1.7.3",
    "build_hash" : "NA",
    "build_timestamp" : "NA",
    "build_snapshot" : false,
    "lucene_version" : "4.10.4"
  },
  "tagline" : "You Know, for Search"
}

Therefore my questions are: Is it a problem everyone can access this URL? Is it a security breach? Please provide resources to make your point, if possible.

If yes, how to solve this? I tried to block access to everyone on port 9200, and only authorize localhost with iptables, but Elasticsearch then stopped working.