Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Documents
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
Microsoft InfoPath 2013 STIG
DTOO170 - 2003 forms as email
InfoPath 2003 forms as email forms in InfoPath 2013 must be disallowed.
InfoPath 2003 forms as email forms in InfoPath 2013 must be disallowed.
An XCCDF Rule
Details
Profiles
Prose
InfoPath 2003 forms as email forms in InfoPath 2013 must be disallowed.
Medium Severity
<VulnDiscussion>An attacker might target InfoPath 2003 forms to try and compromise an organization's security. InfoPath 2003 did not write a published location for email forms, which means forms could open without a corresponding published location. By default, InfoPath sends all forms via email using InfoPath email forms integration, including forms created using the InfoPath 2003 file format.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>