Last Modified: Aug 19, 2026
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
12.1.1, 12.1.1 hf1, 12.1.1 hf2, 12.1.2, 12.1.2 hf1, 12.1.2 hf2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 12.1.5, 12.1.5.1, 12.1.5.2, 12.1.5.3, 12.1.6, 13.0.0, 13.0.0 hf1, 13.0.0 hf2, 13.0.0 hf3, 13.0.1
Fixed In:
13.1.0
Opened: Dec 07, 2016 Severity: 3-Major Related Article:
K24114230
ASM reports false positive violation for the XML request.
When one of the following 3 byte chars arrives to the XML parser, the payload considered as malformed XML: LEFT-TO-RIGHT EMBEDDING (202a). RIGHT-TO-LEFT EMBEDDING (202b). POP DIRECTIONAL FORMATTING(202c).
This occurs when using "%E2%80%AC" POP DIRECTIONAL FORMATTING as a input in the XML request.
None.
This release now supports the following 3 byte chars within the XML parser: LEFT-TO-RIGHT EMBEDDING (202a). RIGHT-TO-LEFT EMBEDDING (202b). POP DIRECTIONAL FORMATTING(202c).