ViewState is not Encrypted
Severity: Low
Summary
Netsparker detected that ViewState encryption is disabled.
Impact
An attacker can study the application's state management logic for possible vulnerabilities; if your application stores application-critical information in the ViewState, it will also be revealed.
Remediation
ASP.NET provides encryption for ViewState parameters.
For page based protection, place the following directive at the top of affected page.
For page based protection, place the following directive at the top of affected page.
<%@Page ViewStateEncryptionMode="Always" %>You can also set this option for the whole application by using
web.config files. Apply the following configuration for your application's web.config file.
<System.Web>
<pages viewStateEncryptionMode="Always">
</System.Web>
Classifications
WASC-15, OWASP 2017-A6
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
