CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony UX versions 2.8.0 to 2.36.0 and 3.1.0, where improper handling of DateTimeInterface types allows attackers to bypass time-based business logic checks by supplying relative date strings. This can lead to unauthorized access or manipulation of time-sensitive data. Developers using the affected versions should prioritize updating to versions 2.36.0 or 3.1.0 to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)