Title

Opening behavior for EMail forms containing code or scripts must be controlled. (Cat II impact)

Discussion

InfoPath notifies and prompts users before opening InfoPath e-mail forms that contain code or script. If this restriction is relaxed, InfoPath will open e-mail forms that contain code or script without prompting users, which could allow malicious code to run on the users' computers.

Check Content

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms “Control behavior when opening InfoPath e-mail forms containing code or script” to “Enabled (Prompt before running)”.

Additional Identifiers

Rule ID: SV-33627r1_rule

Vulnerability ID: V-17580

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.