Details
An attacker might target InfoPath 2003 forms to try and compromise an organization’s security. InfoPath 2003 did not write a published location for e-mail forms, which means forms could open without a corresponding published location.
By default, InfoPath sends all forms via e-mail using InfoPath e-mail forms integration, including forms created using the InfoPath 2003 file format.
Solution
Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms ‘Disable sending InfoPath 2003 Forms as e-mail forms’ to ‘Enabled’.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.
References
- 800-53|SC-18(4)
- CAT|II
- CCI|CCI-001170
- Rule-ID|SV-33646r1_rule
- STIG-ID|DTOO170
- Vuln-ID|V-17668