There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF attack, an attacker will have to be able to get both viewstate value and event validation value. If that is the case, is the form safe from CSRF attacks?
Change password forms are commonly bad targets for CSRF attacks as, if they're following good practice, they'll require the users existing password (failure to do so would be a security weakness in and of itself), which someone exploiting a CSRF vuln. is unlikely to know (and if they did, in most cases they would just use that and not bother with CSRF)
Viewstate and event validation won't, in and of themselves, provide complete protection from CSRF if the attacker has an account on the app and can get valid values to submit. The user of ViewStateUserKey can protect against CSRF (See this question) for more details.