Opening behavior for EMail forms containing code or scripts must be controlled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-17580 | DTOO167 - InfoPath | SV-33627r1_rule | ECSC-1 | Medium |
| Description |
|---|
| InfoPath notifies and prompts users before opening InfoPath e-mail forms that contain code or script. If this restriction is relaxed, InfoPath will open e-mail forms that contain code or script without prompting users, which could allow malicious code to run on the users' computers. |
| STIG | Date |
|---|---|
| Microsoft InfoPath 2010 | 2015-04-16 |
Details
| Check Text ( None ) |
|---|
| None |
| Fix Text (F-29770r1_fix) |
|---|
| Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms “Control behavior when opening InfoPath e-mail forms containing code or script” to “Enabled (Prompt before running)”. |