A form script calling a plain HTTP endpoint
What it is
Client script calls an external endpoint over plaintext HTTP.
Why it matters
A form script calls a plaintext endpoint. Usually the browser blocks it as mixed content and the feature silently does nothing; where the block is relaxed, the request goes out in the clear from the signed-in user's own session.
Both outcomes are worth knowing, which is why this sits one tier below the server-side plaintext findings rather than being dropped: it is dead-or-dangerous configuration rather than a standing plaintext channel. Worth checking whether the script should be holding a key at all, since anything a form script carries is readable by every user who opens the form. Only literal destinations are detectable, so the result is a floor.
Find it yourself
Open each form script and HTML web resource and search for http:// destinations. Worth opening the browser console on a form you suspect: a blocked mixed-content request logs there, which is often the first sign a feature has been quietly dead for months. Only literal destinations are findable, so the result is a floor.
How to fix it
Change the call to https and re-test the form with the browser console open, so a blocked request cannot hide.
Related controls
These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.
CMMC relevance
This condition produces evidence for SC.L2-3.13.8 (Level 2: use cryptographic mechanisms to prevent disclosure of CUI in transmission), for the Dataverse system in your assessment scope. Two outcomes and both matter. Usually the browser blocks the plaintext request from a secure page, so the feature silently does nothing and the only trace is a console message nobody is watching. Where the block is relaxed, the request goes out in the clear from the signed-in user's own session.
Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.
Pathix checks this across every environment you scan, along with 39 other conditions. Self-hosted in your own Azure, read-only, metadata-only.