Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4
Fixed In:
12.0.0, 11.6.0 HF5, 11.5.3
Opened: Dec 19, 2014 Severity: 3-Major
Application DoS can not be tuned in order to tell which transactions are qualified for client side mitigation.
URL will be detected as non-qualified. AVR does not qualify URLs according to the system's qualification criteria.
This occurs in response to the following scenario: 1. Create new L7-DoS profile, enable CS injection prevention. 2. Send more than 10 requests to a qualified URL. Make sure that URL is detected as qualified. 3. Send 1 request with HEAD or TRACE methods.
None.
This release provides tuning for the Application DoS URL qualification criteria.