ViewState is not Encrypted
Severity: Low
Summary #
Netsparker detected that ViewState Encryption is disabled.
Impact #
An attacker can study the application's state management logic for possible vulnerabilities; if your application stores application-critical information in the ViewState, it will also be revealed.
Remediation #
ASP.NET provides encryption for ViewState parameters.
For page based protection, place the following directive at the top of affected page.
For page based protection, place the following directive at the top of affected page.
<%@Page ViewStateEncryptionMode="Always" %>You can also set this option for the whole application by using
web.config files. Apply the following configuration for your application's web.config file.
<System.Web>
<pages viewStateEncryptionMode="Always">
</System.Web>
Classifications #
CWE-16, HIPAA-16, ISO27001-A.14.2.5, WASC-15, OWASP 2017-A6
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
