Description

The __VIEWSTATE parameter is not encrypted for one or more pages. To reduce the chance of someone intercepting the information stored in the ViewState, it is good design to encrypt the ViewState.

Remediation

Turn on the encryption mode for the view state. Consult web references for more information, taking into consideration ASP.NET version

References

Page.ViewStateEncryptionMode Property

Cryptographic Improvements in ASP.NET 4.5, pt. 2

Working with ViewState

Related Vulnerabilities

WordPress Plugin WP Online Store Local File Include and Multiple File Disclosure Vulnerabilities (1.3.1)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Information Disclosure (3.4.7)

WordPress 4.9.x Multiple Vulnerabilities (4.9 - 4.9.23)

Apache stronghold-info enabled

Stack Trace Disclosure (NodeJS)

Severity

Low

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure