Disabling sending form templates with the email forms must be configured.

From Microsoft InfoPath 2010

Part of DTOO168 - Sending templates with email form

SV-33639r1_rule Disabling sending form templates with the email forms must be configured.

Vulnerability discussion

InfoPath allows users to attach form templates when sending e-mail forms. If users are able to open form templates included with e-mail forms, rather than using a cached version that is previously published, an attacker could send a malicious form template with the e-mail form in an attempt to gain access to sensitive information.Note: The form template is only opened directly if the form opens with a restricted security level. Otherwise the attachment is actually a link to the published location.

Check content

The policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms “Disable sending form template with e-mail forms” must be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\14.0\infopath\deployment Criteria: If the value MailXSNwithXML is REG_DWORD = 0, this is not a finding.

Fix text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2010 -> InfoPath e-mail forms “Disable sending form template with e-mail forms” to “Enabled”.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.