Acunetix 360 detected that MAC validation is disabled in ViewState data.
An attacker can tamper with the application's state variables located in the ViewState data structure.
Actions To Take
- For page-based protection, place the following directive at the top of affected page.
<%@Page EnableViewStateMAC=true %>
- You can also set this option for the whole application by using
web.configfiles. Apply the following configuration for your application's
<System.Web> <pages enableViewStateMac="true"> </System.Web>
ASP.NET uses a hash code-based integrity solution called "ViewStateMac" to protect ViewState parameters against tampering attacks. You can implement this solution on a page or application level.