Details
InfoPath provides three security levels for form templates: Restricted, Domain, and Full Trust. The security levels determine whether a form template can access data on other domains, or access files and settings on your computer. Fully trusted forms have a Full Trust security level, and can access files and settings on users’ computers. The form template for these forms must be digitally signed with a trusted root certificate, or installed on users’ computers.
By default, InfoPath can open e-mail forms with full trust. If an attacker designs and sends a dangerous fully trusted e-mail form, it could affect users’ computers or give the attacker access to sensitive information.
Solution
Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms ‘Disable e-mail forms from the Full Trust security zone’ to ‘Enabled’.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.
References
- 800-53|SC-18(4)
- CAT|II
- CCI|CCI-001170
- Rule-ID|SV-33631r1_rule
- STIG-ID|DTOO173
- Vuln-ID|V-17655