Description
projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the information in the UserName and Password tags of the response.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://securityreason.com/securityalert/2047 ↗
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051316.html ↗
- http://securitytracker.com/id?1017388 ↗
- http://secunia.com/advisories/23391 ↗
- http://www.securityfocus.com/archive/1/454497/100/0/threaded ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30905 ↗
- http://www.vupen.com/english/advisories/2006/5038 ↗
- http://www.securityfocus.com/bid/21611 ↗