Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Opening behavior for EMail forms containing code or scripts must be controlled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-17580 | DTOO167 - InfoPath | SV-33627r1_rule | ECSC-1 | Medium |
| Description |
|---|
| InfoPath notifies and prompts users before opening InfoPath e-mail forms that contain code or script. If this restriction is relaxed, InfoPath will open e-mail forms that contain code or script without prompting users, which could allow malicious code to run on the users' computers. |
| STIG | Date |
|---|---|
| Microsoft InfoPath 2010 | 2015-04-16 |
Details
| Check Text ( None ) |
|---|
| None |
| Fix Text (F-29770r1_fix) |
|---|
| Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms “Control behavior when opening InfoPath e-mail forms containing code or script” to “Enabled (Prompt before running)”. |