Description

The __VIEWSTATE parameter is not encrypted for one or more pages. To reduce the chance of someone intercepting the information stored in the ViewState, it is good design to encrypt the ViewState.

Remediation

Turn on the encryption mode for the view state. Consult web references for more information, taking into consideration ASP.NET version

References

Page.ViewStateEncryptionMode Property

Cryptographic Improvements in ASP.NET 4.5, pt. 2

Working with ViewState

Related Vulnerabilities

Ruby on Rails Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-3086)

WordPress Plugin Debug Log Manager Information Disclosure (2.2.2)

Development configuration files

MongoDB HTTP status interface

Tiki Wiki CMS: Arbitrary File Download

Severity

Low

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure