Microsoft InfoPath 2010 Security Technical Implementation Guide

The Microsoft InfoPath 2010 Security Technical Implementation Guide (V1 R12) has 25 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

25STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R12

CurrentPublished Wed Jul 24 2024

InfoPath must be enforced to not use e-mail forms from the Intranet security zone.

Microsoft InfoPath 2010 Security Technical Implementation Guide

Assessment Title

Rule Text

InfoPath must be enforced to not use e-mail forms from the Intranet security zone.

Description

Discussion Text

InfoPath e-mail forms can be designed by an internal attacker and sent over the local intranet, and users might fill out such forms and provide sensitive information to the attacker. By default, forms that originate from the local intranet can be opened.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-241905

Rule

SV-241905r961092_rule

Severity

medium

Rule Version

DTOO294 - InfoPath

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

The policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms "Disable e-mail forms from the Intranet security zone" must be set to "Enabled".

Procedure: Use the Windows Registry Editor to navigate to the following key: 

HKCU\Software\Policies\Microsoft\Office\14.0\infopath\security

Criteria: If the value EnableIntranetEMailForms is REG_DWORD = 0, this is not a finding.

Implementation Procedure

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms "Disable e-mail forms from the Intranet security zone" to "Enabled".

STIG check 20 of 25 in the Microsoft InfoPath 2010 STIG checklist

← Previous · V-241904Email with InfoPath forms must be configured to show UI to recipients.Next · V-241906 →InfoPath e-mail forms in Outlook must be disallowed.