Disabling of email forms from the Full Trust Security Zone must be configured.

From Microsoft InfoPath 2013 STIG

Part of DTOO173 - E-Mail forms from Full Trust Zone

SV-53383r1_rule Disabling of email forms from the Full Trust Security Zone must be configured.

Vulnerability discussion

InfoPath provides three security levels for form templates: Restricted, Domain, and Full Trust. The security levels determine whether a form template can access data on other domains, or access files and settings on your computer. Fully trusted forms have a Full Trust security level, and can access files and settings on users' computers. The form template for these forms must be digitally signed with a trusted root certificate, or installed on users' computers.By default, InfoPath can open email forms with full trust. If an attacker designs and sends a dangerous fully trusted email form, it could affect users' computers or give the attacker access to sensitive information.

Check content

Fix text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2013 -> InfoPath e-mail forms "Disable e-mail forms from the Full Trust security zone" to "Enabled".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.