UpHeron
All vulnerabilities

Servers and applications

CVE-2023-47106

Incorrect processing of fragment in the URL leads to Authorization Bypass

Severity
Medium 6.5
Published
4 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.10.6, 3.0.0-beta5
Also known as
GHSA-fvhj-4qfh-q2hm
Sources
NVD, Project advisories (GitHub)

Description

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to…

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version up to 2.10.5
  • Version 3.0.0-beta1
  • Version 3.0.0-beta2
  • Version 3.0.0-beta3
  • Version 3.0.0-beta4
TraefikServers and applications · github:traefik/traefik
  • Every version up to 1.7.34
  • Every version before 2.10.6
  • Every version before 3.0.0-beta5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-47106
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-47106
  • GitHub Advisory Database https://github.com/advisories/GHSA-fvhj-4qfh-q2hm
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hm