Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

am_gli_287451's avatar
am_gli_287451
Icon for Nimbostratus rankNimbostratus
Apr 19, 2018

ASM cookie exposing server name?

Hi,   I just ran into an issue regarding ASM cookies. I have a transparent policy for a VS in place, that is called by an external portal. This external portal works with java and they get some ex...
application delivery
ASM Advanced WAF
cookie
security
PeteWhite's avatar
PeteWhite
Icon for Employee rankEmployee
Apr 19, 2018

These are two different cookies - the original server name seems to be in the JSESSIONID cookie which is set by the server. I would suggest that you do some more tcpdumping and see where the issue lies. You can quite easily manipulate the cookies with either iRules ( flexible but require some iRule knowledge ) or LTM policies ( operationally more easy to manage than iRules but less flexible )