When activating or deactivating a policy via the tool_policy handler, we are seeing OWASP Core Rule Set Protocol Attack rule 921180 triggered and the page is being blocked. This is because the sesskey parameter is being passed twice in the GET request to page /admin/tool/policy/editpolicydoc.php (essentially we are witnessing parameter pollution).

Steps to reproduce:

1. Activate Policies (tool_policy)
2. Add a new policy
3. Enable policy

Note that you don't need a firewall to confirm the parameter is being passed twice.