Last Modified: Sep 01, 2025
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
17.5.0, 17.5.1
Opened: Mar 05, 2025 Severity: 3-Major
The parameter value in GET requests are considered as base64 even when the calculated score is below 'base64_max_score' Params and headers configured as "Base64Decode=required" do not detect base64 encoded attack signatures.
No Violations Detected, while the parameter included an attack signature (PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg== is the base64 encoded value of <script>alert(1)</script>)
-- Create a parameter named "param" configured as "Base64Decode=required". -- Send Request to URL /?param=PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
None
None