Summary

Acunetix 360 detected that ViewState Encryption is disabled.

Impact

An attacker can study the application's state management logic for possible vulnerabilities; if your application stores application-critical information in the ViewState, it will also be revealed.

Remediation

ASP.NET provides encryption for ViewState parameters.

For page based protection, place the following directive at the top of affected page. 
<%@Page ViewStateEncryptionMode="Always" %>
You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file. 
<System.Web>
    <pages viewStateEncryptionMode="Always">
</System.Web>

Severity

Low

Classification

CWE-16 HIPAA-164.306(a) 164.308(a) ISO27001-A.14.2.5 WASC-15 OWASP 2017-A6